?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
virtio: don't enable notifications during polling
[qemu.git] / hw / virtio / virtio.c
blob95d8ff8508148bf6d29ef69d8e8afc16a77f069f
1 /*
2 * Virtio Support
3 *
4 * Copyright IBM, Corp. 2007
5 *
6 * Authors:
7 * Anthony Liguori <aliguori@us.ibm.com>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
11 *
12 */
13
14 #include "qemu/osdep.h"
15 #include "qapi/error.h"
16 #include "cpu.h"
17 #include "trace.h"
18 #include "exec/address-spaces.h"
19 #include "qemu/error-report.h"
20 #include "qemu/main-loop.h"
21 #include "qemu/module.h"
22 #include "hw/virtio/virtio.h"
23 #include "migration/qemu-file-types.h"
24 #include "qemu/atomic.h"
25 #include "hw/virtio/virtio-bus.h"
26 #include "hw/qdev-properties.h"
27 #include "hw/virtio/virtio-access.h"
28 #include "sysemu/dma.h"
29 #include "sysemu/runstate.h"
30
31 /*
32 * The alignment to use between consumer and producer parts of vring.
33 * x86 pagesize again. This is the default, used by transports like PCI
34 * which don't provide a means for the guest to tell the host the alignment.
35 */
36 #define VIRTIO_PCI_VRING_ALIGN 4096
37
38 typedef struct VRingDesc
39 {
40 uint64_t addr;
41 uint32_t len;
42 uint16_t flags;
43 uint16_t next;
44 } VRingDesc;
45
46 typedef struct VRingPackedDesc {
47 uint64_t addr;
48 uint32_t len;
49 uint16_t id;
50 uint16_t flags;
51 } VRingPackedDesc;
52
53 typedef struct VRingAvail
54 {
55 uint16_t flags;
56 uint16_t idx;
57 uint16_t ring[0];
58 } VRingAvail;
59
60 typedef struct VRingUsedElem
61 {
62 uint32_t id;
63 uint32_t len;
64 } VRingUsedElem;
65
66 typedef struct VRingUsed
67 {
68 uint16_t flags;
69 uint16_t idx;
70 VRingUsedElem ring[0];
71 } VRingUsed;
72
73 typedef struct VRingMemoryRegionCaches {
74 struct rcu_head rcu;
75 MemoryRegionCache desc;
76 MemoryRegionCache avail;
77 MemoryRegionCache used;
78 } VRingMemoryRegionCaches;
79
80 typedef struct VRing
81 {
82 unsigned int num;
83 unsigned int num_default;
84 unsigned int align;
85 hwaddr desc;
86 hwaddr avail;
87 hwaddr used;
88 VRingMemoryRegionCaches *caches;
89 } VRing;
90
91 typedef struct VRingPackedDescEvent {
92 uint16_t off_wrap;
93 uint16_t flags;
94 } VRingPackedDescEvent ;
95
96 struct VirtQueue
97 {
98 VRing vring;
99 VirtQueueElement *used_elems;
100
101 /* Next head to pop */
102 uint16_t last_avail_idx;
103 bool last_avail_wrap_counter;
104
105 /* Last avail_idx read from VQ. */
106 uint16_t shadow_avail_idx;
107 bool shadow_avail_wrap_counter;
108
109 uint16_t used_idx;
110 bool used_wrap_counter;
111
112 /* Last used index value we have signalled on */
113 uint16_t signalled_used;
114
115 /* Last used index value we have signalled on */
116 bool signalled_used_valid;
117
118 /* Notification enabled? */
119 bool notification;
120
121 uint16_t queue_index;
122
123 unsigned int inuse;
124
125 uint16_t vector;
126 VirtIOHandleOutput handle_output;
127 VirtIOHandleAIOOutput handle_aio_output;
128 VirtIODevice *vdev;
129 EventNotifier guest_notifier;
130 EventNotifier host_notifier;
131 bool host_notifier_enabled;
132 QLIST_ENTRY(VirtQueue) node;
133 };
134
135 static void virtio_free_region_cache(VRingMemoryRegionCaches *caches)
136 {
137 if (!caches) {
138 return;
139 }
140
141 address_space_cache_destroy(&caches->desc);
142 address_space_cache_destroy(&caches->avail);
143 address_space_cache_destroy(&caches->used);
144 g_free(caches);
145 }
146
147 static void virtio_virtqueue_reset_region_cache(struct VirtQueue *vq)
148 {
149 VRingMemoryRegionCaches *caches;
150
151 caches = atomic_read(&vq->vring.caches);
152 atomic_rcu_set(&vq->vring.caches, NULL);
153 if (caches) {
154 call_rcu(caches, virtio_free_region_cache, rcu);
155 }
156 }
157
158 static void virtio_init_region_cache(VirtIODevice *vdev, int n)
159 {
160 VirtQueue *vq = &vdev->vq[n];
161 VRingMemoryRegionCaches *old = vq->vring.caches;
162 VRingMemoryRegionCaches *new = NULL;
163 hwaddr addr, size;
164 int64_t len;
165 bool packed;
166
167
168 addr = vq->vring.desc;
169 if (!addr) {
170 goto out_no_cache;
171 }
172 new = g_new0(VRingMemoryRegionCaches, 1);
173 size = virtio_queue_get_desc_size(vdev, n);
174 packed = virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED) ?
175 true : false;
176 len = address_space_cache_init(&new->desc, vdev->dma_as,
177 addr, size, packed);
178 if (len < size) {
179 virtio_error(vdev, "Cannot map desc");
180 goto err_desc;
181 }
182
183 size = virtio_queue_get_used_size(vdev, n);
184 len = address_space_cache_init(&new->used, vdev->dma_as,
185 vq->vring.used, size, true);
186 if (len < size) {
187 virtio_error(vdev, "Cannot map used");
188 goto err_used;
189 }
190
191 size = virtio_queue_get_avail_size(vdev, n);
192 len = address_space_cache_init(&new->avail, vdev->dma_as,
193 vq->vring.avail, size, false);
194 if (len < size) {
195 virtio_error(vdev, "Cannot map avail");
196 goto err_avail;
197 }
198
199 atomic_rcu_set(&vq->vring.caches, new);
200 if (old) {
201 call_rcu(old, virtio_free_region_cache, rcu);
202 }
203 return;
204
205 err_avail:
206 address_space_cache_destroy(&new->avail);
207 err_used:
208 address_space_cache_destroy(&new->used);
209 err_desc:
210 address_space_cache_destroy(&new->desc);
211 out_no_cache:
212 g_free(new);
213 virtio_virtqueue_reset_region_cache(vq);
214 }
215
216 /* virt queue functions */
217 void virtio_queue_update_rings(VirtIODevice *vdev, int n)
218 {
219 VRing *vring = &vdev->vq[n].vring;
220
221 if (!vring->num || !vring->desc || !vring->align) {
222 /* not yet setup -> nothing to do */
223 return;
224 }
225 vring->avail = vring->desc + vring->num * sizeof(VRingDesc);
226 vring->used = vring_align(vring->avail +
227 offsetof(VRingAvail, ring[vring->num]),
228 vring->align);
229 virtio_init_region_cache(vdev, n);
230 }
231
232 /* Called within rcu_read_lock(). */
233 static void vring_split_desc_read(VirtIODevice *vdev, VRingDesc *desc,
234 MemoryRegionCache *cache, int i)
235 {
236 address_space_read_cached(cache, i * sizeof(VRingDesc),
237 desc, sizeof(VRingDesc));
238 virtio_tswap64s(vdev, &desc->addr);
239 virtio_tswap32s(vdev, &desc->len);
240 virtio_tswap16s(vdev, &desc->flags);
241 virtio_tswap16s(vdev, &desc->next);
242 }
243
244 static void vring_packed_event_read(VirtIODevice *vdev,
245 MemoryRegionCache *cache,
246 VRingPackedDescEvent *e)
247 {
248 hwaddr off_off = offsetof(VRingPackedDescEvent, off_wrap);
249 hwaddr off_flags = offsetof(VRingPackedDescEvent, flags);
250
251 address_space_read_cached(cache, off_flags, &e->flags,
252 sizeof(e->flags));
253 /* Make sure flags is seen before off_wrap */
254 smp_rmb();
255 address_space_read_cached(cache, off_off, &e->off_wrap,
256 sizeof(e->off_wrap));
257 virtio_tswap16s(vdev, &e->off_wrap);
258 virtio_tswap16s(vdev, &e->flags);
259 }
260
261 static void vring_packed_off_wrap_write(VirtIODevice *vdev,
262 MemoryRegionCache *cache,
263 uint16_t off_wrap)
264 {
265 hwaddr off = offsetof(VRingPackedDescEvent, off_wrap);
266
267 virtio_tswap16s(vdev, &off_wrap);
268 address_space_write_cached(cache, off, &off_wrap, sizeof(off_wrap));
269 address_space_cache_invalidate(cache, off, sizeof(off_wrap));
270 }
271
272 static void vring_packed_flags_write(VirtIODevice *vdev,
273 MemoryRegionCache *cache, uint16_t flags)
274 {
275 hwaddr off = offsetof(VRingPackedDescEvent, flags);
276
277 virtio_tswap16s(vdev, &flags);
278 address_space_write_cached(cache, off, &flags, sizeof(flags));
279 address_space_cache_invalidate(cache, off, sizeof(flags));
280 }
281
282 /* Called within rcu_read_lock(). */
283 static VRingMemoryRegionCaches *vring_get_region_caches(struct VirtQueue *vq)
284 {
285 VRingMemoryRegionCaches *caches = atomic_rcu_read(&vq->vring.caches);
286 assert(caches != NULL);
287 return caches;
288 }
289 /* Called within rcu_read_lock(). */
290 static inline uint16_t vring_avail_flags(VirtQueue *vq)
291 {
292 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
293 hwaddr pa = offsetof(VRingAvail, flags);
294 return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
295 }
296
297 /* Called within rcu_read_lock(). */
298 static inline uint16_t vring_avail_idx(VirtQueue *vq)
299 {
300 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
301 hwaddr pa = offsetof(VRingAvail, idx);
302 vq->shadow_avail_idx = virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
303 return vq->shadow_avail_idx;
304 }
305
306 /* Called within rcu_read_lock(). */
307 static inline uint16_t vring_avail_ring(VirtQueue *vq, int i)
308 {
309 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
310 hwaddr pa = offsetof(VRingAvail, ring[i]);
311 return virtio_lduw_phys_cached(vq->vdev, &caches->avail, pa);
312 }
313
314 /* Called within rcu_read_lock(). */
315 static inline uint16_t vring_get_used_event(VirtQueue *vq)
316 {
317 return vring_avail_ring(vq, vq->vring.num);
318 }
319
320 /* Called within rcu_read_lock(). */
321 static inline void vring_used_write(VirtQueue *vq, VRingUsedElem *uelem,
322 int i)
323 {
324 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
325 hwaddr pa = offsetof(VRingUsed, ring[i]);
326 virtio_tswap32s(vq->vdev, &uelem->id);
327 virtio_tswap32s(vq->vdev, &uelem->len);
328 address_space_write_cached(&caches->used, pa, uelem, sizeof(VRingUsedElem));
329 address_space_cache_invalidate(&caches->used, pa, sizeof(VRingUsedElem));
330 }
331
332 /* Called within rcu_read_lock(). */
333 static uint16_t vring_used_idx(VirtQueue *vq)
334 {
335 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
336 hwaddr pa = offsetof(VRingUsed, idx);
337 return virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
338 }
339
340 /* Called within rcu_read_lock(). */
341 static inline void vring_used_idx_set(VirtQueue *vq, uint16_t val)
342 {
343 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
344 hwaddr pa = offsetof(VRingUsed, idx);
345 virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
346 address_space_cache_invalidate(&caches->used, pa, sizeof(val));
347 vq->used_idx = val;
348 }
349
350 /* Called within rcu_read_lock(). */
351 static inline void vring_used_flags_set_bit(VirtQueue *vq, int mask)
352 {
353 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
354 VirtIODevice *vdev = vq->vdev;
355 hwaddr pa = offsetof(VRingUsed, flags);
356 uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
357
358 virtio_stw_phys_cached(vdev, &caches->used, pa, flags | mask);
359 address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
360 }
361
362 /* Called within rcu_read_lock(). */
363 static inline void vring_used_flags_unset_bit(VirtQueue *vq, int mask)
364 {
365 VRingMemoryRegionCaches *caches = vring_get_region_caches(vq);
366 VirtIODevice *vdev = vq->vdev;
367 hwaddr pa = offsetof(VRingUsed, flags);
368 uint16_t flags = virtio_lduw_phys_cached(vq->vdev, &caches->used, pa);
369
370 virtio_stw_phys_cached(vdev, &caches->used, pa, flags & ~mask);
371 address_space_cache_invalidate(&caches->used, pa, sizeof(flags));
372 }
373
374 /* Called within rcu_read_lock(). */
375 static inline void vring_set_avail_event(VirtQueue *vq, uint16_t val)
376 {
377 VRingMemoryRegionCaches *caches;
378 hwaddr pa;
379 if (!vq->notification) {
380 return;
381 }
382
383 caches = vring_get_region_caches(vq);
384 pa = offsetof(VRingUsed, ring[vq->vring.num]);
385 virtio_stw_phys_cached(vq->vdev, &caches->used, pa, val);
386 address_space_cache_invalidate(&caches->used, pa, sizeof(val));
387 }
388
389 static void virtio_queue_split_set_notification(VirtQueue *vq, int enable)
390 {
391 RCU_READ_LOCK_GUARD();
392
393 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
394 vring_set_avail_event(vq, vring_avail_idx(vq));
395 } else if (enable) {
396 vring_used_flags_unset_bit(vq, VRING_USED_F_NO_NOTIFY);
397 } else {
398 vring_used_flags_set_bit(vq, VRING_USED_F_NO_NOTIFY);
399 }
400 if (enable) {
401 /* Expose avail event/used flags before caller checks the avail idx. */
402 smp_mb();
403 }
404 }
405
406 static void virtio_queue_packed_set_notification(VirtQueue *vq, int enable)
407 {
408 uint16_t off_wrap;
409 VRingPackedDescEvent e;
410 VRingMemoryRegionCaches *caches;
411
412 RCU_READ_LOCK_GUARD();
413 caches = vring_get_region_caches(vq);
414 vring_packed_event_read(vq->vdev, &caches->used, &e);
415
416 if (!enable) {
417 e.flags = VRING_PACKED_EVENT_FLAG_DISABLE;
418 } else if (virtio_vdev_has_feature(vq->vdev, VIRTIO_RING_F_EVENT_IDX)) {
419 off_wrap = vq->shadow_avail_idx | vq->shadow_avail_wrap_counter << 15;
420 vring_packed_off_wrap_write(vq->vdev, &caches->used, off_wrap);
421 /* Make sure off_wrap is wrote before flags */
422 smp_wmb();
423 e.flags = VRING_PACKED_EVENT_FLAG_DESC;
424 } else {
425 e.flags = VRING_PACKED_EVENT_FLAG_ENABLE;
426 }
427
428 vring_packed_flags_write(vq->vdev, &caches->used, e.flags);
429 if (enable) {
430 /* Expose avail event/used flags before caller checks the avail idx. */
431 smp_mb();
432 }
433 }
434
435 bool virtio_queue_get_notification(VirtQueue *vq)
436 {
437 return vq->notification;
438 }
439
440 void virtio_queue_set_notification(VirtQueue *vq, int enable)
441 {
442 vq->notification = enable;
443
444 if (!vq->vring.desc) {
445 return;
446 }
447
448 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
449 virtio_queue_packed_set_notification(vq, enable);
450 } else {
451 virtio_queue_split_set_notification(vq, enable);
452 }
453 }
454
455 int virtio_queue_ready(VirtQueue *vq)
456 {
457 return vq->vring.avail != 0;
458 }
459
460 static void vring_packed_desc_read_flags(VirtIODevice *vdev,
461 uint16_t *flags,
462 MemoryRegionCache *cache,
463 int i)
464 {
465 address_space_read_cached(cache,
466 i * sizeof(VRingPackedDesc) +
467 offsetof(VRingPackedDesc, flags),
468 flags, sizeof(*flags));
469 virtio_tswap16s(vdev, flags);
470 }
471
472 static void vring_packed_desc_read(VirtIODevice *vdev,
473 VRingPackedDesc *desc,
474 MemoryRegionCache *cache,
475 int i, bool strict_order)
476 {
477 hwaddr off = i * sizeof(VRingPackedDesc);
478
479 vring_packed_desc_read_flags(vdev, &desc->flags, cache, i);
480
481 if (strict_order) {
482 /* Make sure flags is read before the rest fields. */
483 smp_rmb();
484 }
485
486 address_space_read_cached(cache, off + offsetof(VRingPackedDesc, addr),
487 &desc->addr, sizeof(desc->addr));
488 address_space_read_cached(cache, off + offsetof(VRingPackedDesc, id),
489 &desc->id, sizeof(desc->id));
490 address_space_read_cached(cache, off + offsetof(VRingPackedDesc, len),
491 &desc->len, sizeof(desc->len));
492 virtio_tswap64s(vdev, &desc->addr);
493 virtio_tswap16s(vdev, &desc->id);
494 virtio_tswap32s(vdev, &desc->len);
495 }
496
497 static void vring_packed_desc_write_data(VirtIODevice *vdev,
498 VRingPackedDesc *desc,
499 MemoryRegionCache *cache,
500 int i)
501 {
502 hwaddr off_id = i * sizeof(VRingPackedDesc) +
503 offsetof(VRingPackedDesc, id);
504 hwaddr off_len = i * sizeof(VRingPackedDesc) +
505 offsetof(VRingPackedDesc, len);
506
507 virtio_tswap32s(vdev, &desc->len);
508 virtio_tswap16s(vdev, &desc->id);
509 address_space_write_cached(cache, off_id, &desc->id, sizeof(desc->id));
510 address_space_cache_invalidate(cache, off_id, sizeof(desc->id));
511 address_space_write_cached(cache, off_len, &desc->len, sizeof(desc->len));
512 address_space_cache_invalidate(cache, off_len, sizeof(desc->len));
513 }
514
515 static void vring_packed_desc_write_flags(VirtIODevice *vdev,
516 VRingPackedDesc *desc,
517 MemoryRegionCache *cache,
518 int i)
519 {
520 hwaddr off = i * sizeof(VRingPackedDesc) + offsetof(VRingPackedDesc, flags);
521
522 virtio_tswap16s(vdev, &desc->flags);
523 address_space_write_cached(cache, off, &desc->flags, sizeof(desc->flags));
524 address_space_cache_invalidate(cache, off, sizeof(desc->flags));
525 }
526
527 static void vring_packed_desc_write(VirtIODevice *vdev,
528 VRingPackedDesc *desc,
529 MemoryRegionCache *cache,
530 int i, bool strict_order)
531 {
532 vring_packed_desc_write_data(vdev, desc, cache, i);
533 if (strict_order) {
534 /* Make sure data is wrote before flags. */
535 smp_wmb();
536 }
537 vring_packed_desc_write_flags(vdev, desc, cache, i);
538 }
539
540 static inline bool is_desc_avail(uint16_t flags, bool wrap_counter)
541 {
542 bool avail, used;
543
544 avail = !!(flags & (1 << VRING_PACKED_DESC_F_AVAIL));
545 used = !!(flags & (1 << VRING_PACKED_DESC_F_USED));
546 return (avail != used) && (avail == wrap_counter);
547 }
548
549 /* Fetch avail_idx from VQ memory only when we really need to know if
550 * guest has added some buffers.
551 * Called within rcu_read_lock(). */
552 static int virtio_queue_empty_rcu(VirtQueue *vq)
553 {
554 if (virtio_device_disabled(vq->vdev)) {
555 return 1;
556 }
557
558 if (unlikely(!vq->vring.avail)) {
559 return 1;
560 }
561
562 if (vq->shadow_avail_idx != vq->last_avail_idx) {
563 return 0;
564 }
565
566 return vring_avail_idx(vq) == vq->last_avail_idx;
567 }
568
569 static int virtio_queue_split_empty(VirtQueue *vq)
570 {
571 bool empty;
572
573 if (virtio_device_disabled(vq->vdev)) {
574 return 1;
575 }
576
577 if (unlikely(!vq->vring.avail)) {
578 return 1;
579 }
580
581 if (vq->shadow_avail_idx != vq->last_avail_idx) {
582 return 0;
583 }
584
585 RCU_READ_LOCK_GUARD();
586 empty = vring_avail_idx(vq) == vq->last_avail_idx;
587 return empty;
588 }
589
590 static int virtio_queue_packed_empty_rcu(VirtQueue *vq)
591 {
592 struct VRingPackedDesc desc;
593 VRingMemoryRegionCaches *cache;
594
595 if (unlikely(!vq->vring.desc)) {
596 return 1;
597 }
598
599 cache = vring_get_region_caches(vq);
600 vring_packed_desc_read_flags(vq->vdev, &desc.flags, &cache->desc,
601 vq->last_avail_idx);
602
603 return !is_desc_avail(desc.flags, vq->last_avail_wrap_counter);
604 }
605
606 static int virtio_queue_packed_empty(VirtQueue *vq)
607 {
608 RCU_READ_LOCK_GUARD();
609 return virtio_queue_packed_empty_rcu(vq);
610 }
611
612 int virtio_queue_empty(VirtQueue *vq)
613 {
614 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
615 return virtio_queue_packed_empty(vq);
616 } else {
617 return virtio_queue_split_empty(vq);
618 }
619 }
620
621 static void virtqueue_unmap_sg(VirtQueue *vq, const VirtQueueElement *elem,
622 unsigned int len)
623 {
624 AddressSpace *dma_as = vq->vdev->dma_as;
625 unsigned int offset;
626 int i;
627
628 offset = 0;
629 for (i = 0; i < elem->in_num; i++) {
630 size_t size = MIN(len - offset, elem->in_sg[i].iov_len);
631
632 dma_memory_unmap(dma_as, elem->in_sg[i].iov_base,
633 elem->in_sg[i].iov_len,
634 DMA_DIRECTION_FROM_DEVICE, size);
635
636 offset += size;
637 }
638
639 for (i = 0; i < elem->out_num; i++)
640 dma_memory_unmap(dma_as, elem->out_sg[i].iov_base,
641 elem->out_sg[i].iov_len,
642 DMA_DIRECTION_TO_DEVICE,
643 elem->out_sg[i].iov_len);
644 }
645
646 /* virtqueue_detach_element:
647 * @vq: The #VirtQueue
648 * @elem: The #VirtQueueElement
649 * @len: number of bytes written
650 *
651 * Detach the element from the virtqueue. This function is suitable for device
652 * reset or other situations where a #VirtQueueElement is simply freed and will
653 * not be pushed or discarded.
654 */
655 void virtqueue_detach_element(VirtQueue *vq, const VirtQueueElement *elem,
656 unsigned int len)
657 {
658 vq->inuse -= elem->ndescs;
659 virtqueue_unmap_sg(vq, elem, len);
660 }
661
662 static void virtqueue_split_rewind(VirtQueue *vq, unsigned int num)
663 {
664 vq->last_avail_idx -= num;
665 }
666
667 static void virtqueue_packed_rewind(VirtQueue *vq, unsigned int num)
668 {
669 if (vq->last_avail_idx < num) {
670 vq->last_avail_idx = vq->vring.num + vq->last_avail_idx - num;
671 vq->last_avail_wrap_counter ^= 1;
672 } else {
673 vq->last_avail_idx -= num;
674 }
675 }
676
677 /* virtqueue_unpop:
678 * @vq: The #VirtQueue
679 * @elem: The #VirtQueueElement
680 * @len: number of bytes written
681 *
682 * Pretend the most recent element wasn't popped from the virtqueue. The next
683 * call to virtqueue_pop() will refetch the element.
684 */
685 void virtqueue_unpop(VirtQueue *vq, const VirtQueueElement *elem,
686 unsigned int len)
687 {
688
689 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
690 virtqueue_packed_rewind(vq, 1);
691 } else {
692 virtqueue_split_rewind(vq, 1);
693 }
694
695 virtqueue_detach_element(vq, elem, len);
696 }
697
698 /* virtqueue_rewind:
699 * @vq: The #VirtQueue
700 * @num: Number of elements to push back
701 *
702 * Pretend that elements weren't popped from the virtqueue. The next
703 * virtqueue_pop() will refetch the oldest element.
704 *
705 * Use virtqueue_unpop() instead if you have a VirtQueueElement.
706 *
707 * Returns: true on success, false if @num is greater than the number of in use
708 * elements.
709 */
710 bool virtqueue_rewind(VirtQueue *vq, unsigned int num)
711 {
712 if (num > vq->inuse) {
713 return false;
714 }
715
716 vq->inuse -= num;
717 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
718 virtqueue_packed_rewind(vq, num);
719 } else {
720 virtqueue_split_rewind(vq, num);
721 }
722 return true;
723 }
724
725 static void virtqueue_split_fill(VirtQueue *vq, const VirtQueueElement *elem,
726 unsigned int len, unsigned int idx)
727 {
728 VRingUsedElem uelem;
729
730 if (unlikely(!vq->vring.used)) {
731 return;
732 }
733
734 idx = (idx + vq->used_idx) % vq->vring.num;
735
736 uelem.id = elem->index;
737 uelem.len = len;
738 vring_used_write(vq, &uelem, idx);
739 }
740
741 static void virtqueue_packed_fill(VirtQueue *vq, const VirtQueueElement *elem,
742 unsigned int len, unsigned int idx)
743 {
744 vq->used_elems[idx].index = elem->index;
745 vq->used_elems[idx].len = len;
746 vq->used_elems[idx].ndescs = elem->ndescs;
747 }
748
749 static void virtqueue_packed_fill_desc(VirtQueue *vq,
750 const VirtQueueElement *elem,
751 unsigned int idx,
752 bool strict_order)
753 {
754 uint16_t head;
755 VRingMemoryRegionCaches *caches;
756 VRingPackedDesc desc = {
757 .id = elem->index,
758 .len = elem->len,
759 };
760 bool wrap_counter = vq->used_wrap_counter;
761
762 if (unlikely(!vq->vring.desc)) {
763 return;
764 }
765
766 head = vq->used_idx + idx;
767 if (head >= vq->vring.num) {
768 head -= vq->vring.num;
769 wrap_counter ^= 1;
770 }
771 if (wrap_counter) {
772 desc.flags |= (1 << VRING_PACKED_DESC_F_AVAIL);
773 desc.flags |= (1 << VRING_PACKED_DESC_F_USED);
774 } else {
775 desc.flags &= ~(1 << VRING_PACKED_DESC_F_AVAIL);
776 desc.flags &= ~(1 << VRING_PACKED_DESC_F_USED);
777 }
778
779 caches = vring_get_region_caches(vq);
780 vring_packed_desc_write(vq->vdev, &desc, &caches->desc, head, strict_order);
781 }
782
783 /* Called within rcu_read_lock(). */
784 void virtqueue_fill(VirtQueue *vq, const VirtQueueElement *elem,
785 unsigned int len, unsigned int idx)
786 {
787 trace_virtqueue_fill(vq, elem, len, idx);
788
789 virtqueue_unmap_sg(vq, elem, len);
790
791 if (virtio_device_disabled(vq->vdev)) {
792 return;
793 }
794
795 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
796 virtqueue_packed_fill(vq, elem, len, idx);
797 } else {
798 virtqueue_split_fill(vq, elem, len, idx);
799 }
800 }
801
802 /* Called within rcu_read_lock(). */
803 static void virtqueue_split_flush(VirtQueue *vq, unsigned int count)
804 {
805 uint16_t old, new;
806
807 if (unlikely(!vq->vring.used)) {
808 return;
809 }
810
811 /* Make sure buffer is written before we update index. */
812 smp_wmb();
813 trace_virtqueue_flush(vq, count);
814 old = vq->used_idx;
815 new = old + count;
816 vring_used_idx_set(vq, new);
817 vq->inuse -= count;
818 if (unlikely((int16_t)(new - vq->signalled_used) < (uint16_t)(new - old)))
819 vq->signalled_used_valid = false;
820 }
821
822 static void virtqueue_packed_flush(VirtQueue *vq, unsigned int count)
823 {
824 unsigned int i, ndescs = 0;
825
826 if (unlikely(!vq->vring.desc)) {
827 return;
828 }
829
830 for (i = 1; i < count; i++) {
831 virtqueue_packed_fill_desc(vq, &vq->used_elems[i], i, false);
832 ndescs += vq->used_elems[i].ndescs;
833 }
834 virtqueue_packed_fill_desc(vq, &vq->used_elems[0], 0, true);
835 ndescs += vq->used_elems[0].ndescs;
836
837 vq->inuse -= ndescs;
838 vq->used_idx += ndescs;
839 if (vq->used_idx >= vq->vring.num) {
840 vq->used_idx -= vq->vring.num;
841 vq->used_wrap_counter ^= 1;
842 }
843 }
844
845 void virtqueue_flush(VirtQueue *vq, unsigned int count)
846 {
847 if (virtio_device_disabled(vq->vdev)) {
848 vq->inuse -= count;
849 return;
850 }
851
852 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
853 virtqueue_packed_flush(vq, count);
854 } else {
855 virtqueue_split_flush(vq, count);
856 }
857 }
858
859 void virtqueue_push(VirtQueue *vq, const VirtQueueElement *elem,
860 unsigned int len)
861 {
862 RCU_READ_LOCK_GUARD();
863 virtqueue_fill(vq, elem, len, 0);
864 virtqueue_flush(vq, 1);
865 }
866
867 /* Called within rcu_read_lock(). */
868 static int virtqueue_num_heads(VirtQueue *vq, unsigned int idx)
869 {
870 uint16_t num_heads = vring_avail_idx(vq) - idx;
871
872 /* Check it isn't doing very strange things with descriptor numbers. */
873 if (num_heads > vq->vring.num) {
874 virtio_error(vq->vdev, "Guest moved used index from %u to %u",
875 idx, vq->shadow_avail_idx);
876 return -EINVAL;
877 }
878 /* On success, callers read a descriptor at vq->last_avail_idx.
879 * Make sure descriptor read does not bypass avail index read. */
880 if (num_heads) {
881 smp_rmb();
882 }
883
884 return num_heads;
885 }
886
887 /* Called within rcu_read_lock(). */
888 static bool virtqueue_get_head(VirtQueue *vq, unsigned int idx,
889 unsigned int *head)
890 {
891 /* Grab the next descriptor number they're advertising, and increment
892 * the index we've seen. */
893 *head = vring_avail_ring(vq, idx % vq->vring.num);
894
895 /* If their number is silly, that's a fatal mistake. */
896 if (*head >= vq->vring.num) {
897 virtio_error(vq->vdev, "Guest says index %u is available", *head);
898 return false;
899 }
900
901 return true;
902 }
903
904 enum {
905 VIRTQUEUE_READ_DESC_ERROR = -1,
906 VIRTQUEUE_READ_DESC_DONE = 0, /* end of chain */
907 VIRTQUEUE_READ_DESC_MORE = 1, /* more buffers in chain */
908 };
909
910 static int virtqueue_split_read_next_desc(VirtIODevice *vdev, VRingDesc *desc,
911 MemoryRegionCache *desc_cache,
912 unsigned int max, unsigned int *next)
913 {
914 /* If this descriptor says it doesn't chain, we're done. */
915 if (!(desc->flags & VRING_DESC_F_NEXT)) {
916 return VIRTQUEUE_READ_DESC_DONE;
917 }
918
919 /* Check they're not leading us off end of descriptors. */
920 *next = desc->next;
921 /* Make sure compiler knows to grab that: we don't want it changing! */
922 smp_wmb();
923
924 if (*next >= max) {
925 virtio_error(vdev, "Desc next is %u", *next);
926 return VIRTQUEUE_READ_DESC_ERROR;
927 }
928
929 vring_split_desc_read(vdev, desc, desc_cache, *next);
930 return VIRTQUEUE_READ_DESC_MORE;
931 }
932
933 static void virtqueue_split_get_avail_bytes(VirtQueue *vq,
934 unsigned int *in_bytes, unsigned int *out_bytes,
935 unsigned max_in_bytes, unsigned max_out_bytes)
936 {
937 VirtIODevice *vdev = vq->vdev;
938 unsigned int max, idx;
939 unsigned int total_bufs, in_total, out_total;
940 VRingMemoryRegionCaches *caches;
941 MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
942 int64_t len = 0;
943 int rc;
944
945 RCU_READ_LOCK_GUARD();
946
947 idx = vq->last_avail_idx;
948 total_bufs = in_total = out_total = 0;
949
950 max = vq->vring.num;
951 caches = vring_get_region_caches(vq);
952 while ((rc = virtqueue_num_heads(vq, idx)) > 0) {
953 MemoryRegionCache *desc_cache = &caches->desc;
954 unsigned int num_bufs;
955 VRingDesc desc;
956 unsigned int i;
957
958 num_bufs = total_bufs;
959
960 if (!virtqueue_get_head(vq, idx++, &i)) {
961 goto err;
962 }
963
964 vring_split_desc_read(vdev, &desc, desc_cache, i);
965
966 if (desc.flags & VRING_DESC_F_INDIRECT) {
967 if (!desc.len || (desc.len % sizeof(VRingDesc))) {
968 virtio_error(vdev, "Invalid size for indirect buffer table");
969 goto err;
970 }
971
972 /* If we've got too many, that implies a descriptor loop. */
973 if (num_bufs >= max) {
974 virtio_error(vdev, "Looped descriptor");
975 goto err;
976 }
977
978 /* loop over the indirect descriptor table */
979 len = address_space_cache_init(&indirect_desc_cache,
980 vdev->dma_as,
981 desc.addr, desc.len, false);
982 desc_cache = &indirect_desc_cache;
983 if (len < desc.len) {
984 virtio_error(vdev, "Cannot map indirect buffer");
985 goto err;
986 }
987
988 max = desc.len / sizeof(VRingDesc);
989 num_bufs = i = 0;
990 vring_split_desc_read(vdev, &desc, desc_cache, i);
991 }
992
993 do {
994 /* If we've got too many, that implies a descriptor loop. */
995 if (++num_bufs > max) {
996 virtio_error(vdev, "Looped descriptor");
997 goto err;
998 }
999
1000 if (desc.flags & VRING_DESC_F_WRITE) {
1001 in_total += desc.len;
1002 } else {
1003 out_total += desc.len;
1004 }
1005 if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
1006 goto done;
1007 }
1008
1009 rc = virtqueue_split_read_next_desc(vdev, &desc, desc_cache, max, &i);
1010 } while (rc == VIRTQUEUE_READ_DESC_MORE);
1011
1012 if (rc == VIRTQUEUE_READ_DESC_ERROR) {
1013 goto err;
1014 }
1015
1016 if (desc_cache == &indirect_desc_cache) {
1017 address_space_cache_destroy(&indirect_desc_cache);
1018 total_bufs++;
1019 } else {
1020 total_bufs = num_bufs;
1021 }
1022 }
1023
1024 if (rc < 0) {
1025 goto err;
1026 }
1027
1028 done:
1029 address_space_cache_destroy(&indirect_desc_cache);
1030 if (in_bytes) {
1031 *in_bytes = in_total;
1032 }
1033 if (out_bytes) {
1034 *out_bytes = out_total;
1035 }
1036 return;
1037
1038 err:
1039 in_total = out_total = 0;
1040 goto done;
1041 }
1042
1043 static int virtqueue_packed_read_next_desc(VirtQueue *vq,
1044 VRingPackedDesc *desc,
1045 MemoryRegionCache
1046 *desc_cache,
1047 unsigned int max,
1048 unsigned int *next,
1049 bool indirect)
1050 {
1051 /* If this descriptor says it doesn't chain, we're done. */
1052 if (!indirect && !(desc->flags & VRING_DESC_F_NEXT)) {
1053 return VIRTQUEUE_READ_DESC_DONE;
1054 }
1055
1056 ++*next;
1057 if (*next == max) {
1058 if (indirect) {
1059 return VIRTQUEUE_READ_DESC_DONE;
1060 } else {
1061 (*next) -= vq->vring.num;
1062 }
1063 }
1064
1065 vring_packed_desc_read(vq->vdev, desc, desc_cache, *next, false);
1066 return VIRTQUEUE_READ_DESC_MORE;
1067 }
1068
1069 static void virtqueue_packed_get_avail_bytes(VirtQueue *vq,
1070 unsigned int *in_bytes,
1071 unsigned int *out_bytes,
1072 unsigned max_in_bytes,
1073 unsigned max_out_bytes)
1074 {
1075 VirtIODevice *vdev = vq->vdev;
1076 unsigned int max, idx;
1077 unsigned int total_bufs, in_total, out_total;
1078 MemoryRegionCache *desc_cache;
1079 VRingMemoryRegionCaches *caches;
1080 MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
1081 int64_t len = 0;
1082 VRingPackedDesc desc;
1083 bool wrap_counter;
1084
1085 RCU_READ_LOCK_GUARD();
1086 idx = vq->last_avail_idx;
1087 wrap_counter = vq->last_avail_wrap_counter;
1088 total_bufs = in_total = out_total = 0;
1089
1090 max = vq->vring.num;
1091 caches = vring_get_region_caches(vq);
1092
1093 for (;;) {
1094 unsigned int num_bufs = total_bufs;
1095 unsigned int i = idx;
1096 int rc;
1097
1098 desc_cache = &caches->desc;
1099 vring_packed_desc_read(vdev, &desc, desc_cache, idx, true);
1100 if (!is_desc_avail(desc.flags, wrap_counter)) {
1101 break;
1102 }
1103
1104 if (desc.flags & VRING_DESC_F_INDIRECT) {
1105 if (desc.len % sizeof(VRingPackedDesc)) {
1106 virtio_error(vdev, "Invalid size for indirect buffer table");
1107 goto err;
1108 }
1109
1110 /* If we've got too many, that implies a descriptor loop. */
1111 if (num_bufs >= max) {
1112 virtio_error(vdev, "Looped descriptor");
1113 goto err;
1114 }
1115
1116 /* loop over the indirect descriptor table */
1117 len = address_space_cache_init(&indirect_desc_cache,
1118 vdev->dma_as,
1119 desc.addr, desc.len, false);
1120 desc_cache = &indirect_desc_cache;
1121 if (len < desc.len) {
1122 virtio_error(vdev, "Cannot map indirect buffer");
1123 goto err;
1124 }
1125
1126 max = desc.len / sizeof(VRingPackedDesc);
1127 num_bufs = i = 0;
1128 vring_packed_desc_read(vdev, &desc, desc_cache, i, false);
1129 }
1130
1131 do {
1132 /* If we've got too many, that implies a descriptor loop. */
1133 if (++num_bufs > max) {
1134 virtio_error(vdev, "Looped descriptor");
1135 goto err;
1136 }
1137
1138 if (desc.flags & VRING_DESC_F_WRITE) {
1139 in_total += desc.len;
1140 } else {
1141 out_total += desc.len;
1142 }
1143 if (in_total >= max_in_bytes && out_total >= max_out_bytes) {
1144 goto done;
1145 }
1146
1147 rc = virtqueue_packed_read_next_desc(vq, &desc, desc_cache, max,
1148 &i, desc_cache ==
1149 &indirect_desc_cache);
1150 } while (rc == VIRTQUEUE_READ_DESC_MORE);
1151
1152 if (desc_cache == &indirect_desc_cache) {
1153 address_space_cache_destroy(&indirect_desc_cache);
1154 total_bufs++;
1155 idx++;
1156 } else {
1157 idx += num_bufs - total_bufs;
1158 total_bufs = num_bufs;
1159 }
1160
1161 if (idx >= vq->vring.num) {
1162 idx -= vq->vring.num;
1163 wrap_counter ^= 1;
1164 }
1165 }
1166
1167 /* Record the index and wrap counter for a kick we want */
1168 vq->shadow_avail_idx = idx;
1169 vq->shadow_avail_wrap_counter = wrap_counter;
1170 done:
1171 address_space_cache_destroy(&indirect_desc_cache);
1172 if (in_bytes) {
1173 *in_bytes = in_total;
1174 }
1175 if (out_bytes) {
1176 *out_bytes = out_total;
1177 }
1178 return;
1179
1180 err:
1181 in_total = out_total = 0;
1182 goto done;
1183 }
1184
1185 void virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
1186 unsigned int *out_bytes,
1187 unsigned max_in_bytes, unsigned max_out_bytes)
1188 {
1189 uint16_t desc_size;
1190 VRingMemoryRegionCaches *caches;
1191
1192 if (unlikely(!vq->vring.desc)) {
1193 goto err;
1194 }
1195
1196 caches = vring_get_region_caches(vq);
1197 desc_size = virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED) ?
1198 sizeof(VRingPackedDesc) : sizeof(VRingDesc);
1199 if (caches->desc.len < vq->vring.num * desc_size) {
1200 virtio_error(vq->vdev, "Cannot map descriptor ring");
1201 goto err;
1202 }
1203
1204 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
1205 virtqueue_packed_get_avail_bytes(vq, in_bytes, out_bytes,
1206 max_in_bytes, max_out_bytes);
1207 } else {
1208 virtqueue_split_get_avail_bytes(vq, in_bytes, out_bytes,
1209 max_in_bytes, max_out_bytes);
1210 }
1211
1212 return;
1213 err:
1214 if (in_bytes) {
1215 *in_bytes = 0;
1216 }
1217 if (out_bytes) {
1218 *out_bytes = 0;
1219 }
1220 }
1221
1222 int virtqueue_avail_bytes(VirtQueue *vq, unsigned int in_bytes,
1223 unsigned int out_bytes)
1224 {
1225 unsigned int in_total, out_total;
1226
1227 virtqueue_get_avail_bytes(vq, &in_total, &out_total, in_bytes, out_bytes);
1228 return in_bytes <= in_total && out_bytes <= out_total;
1229 }
1230
1231 static bool virtqueue_map_desc(VirtIODevice *vdev, unsigned int *p_num_sg,
1232 hwaddr *addr, struct iovec *iov,
1233 unsigned int max_num_sg, bool is_write,
1234 hwaddr pa, size_t sz)
1235 {
1236 bool ok = false;
1237 unsigned num_sg = *p_num_sg;
1238 assert(num_sg <= max_num_sg);
1239
1240 if (!sz) {
1241 virtio_error(vdev, "virtio: zero sized buffers are not allowed");
1242 goto out;
1243 }
1244
1245 while (sz) {
1246 hwaddr len = sz;
1247
1248 if (num_sg == max_num_sg) {
1249 virtio_error(vdev, "virtio: too many write descriptors in "
1250 "indirect table");
1251 goto out;
1252 }
1253
1254 iov[num_sg].iov_base = dma_memory_map(vdev->dma_as, pa, &len,
1255 is_write ?
1256 DMA_DIRECTION_FROM_DEVICE :
1257 DMA_DIRECTION_TO_DEVICE);
1258 if (!iov[num_sg].iov_base) {
1259 virtio_error(vdev, "virtio: bogus descriptor or out of resources");
1260 goto out;
1261 }
1262
1263 iov[num_sg].iov_len = len;
1264 addr[num_sg] = pa;
1265
1266 sz -= len;
1267 pa += len;
1268 num_sg++;
1269 }
1270 ok = true;
1271
1272 out:
1273 *p_num_sg = num_sg;
1274 return ok;
1275 }
1276
1277 /* Only used by error code paths before we have a VirtQueueElement (therefore
1278 * virtqueue_unmap_sg() can't be used). Assumes buffers weren't written to
1279 * yet.
1280 */
1281 static void virtqueue_undo_map_desc(unsigned int out_num, unsigned int in_num,
1282 struct iovec *iov)
1283 {
1284 unsigned int i;
1285
1286 for (i = 0; i < out_num + in_num; i++) {
1287 int is_write = i >= out_num;
1288
1289 cpu_physical_memory_unmap(iov->iov_base, iov->iov_len, is_write, 0);
1290 iov++;
1291 }
1292 }
1293
1294 static void virtqueue_map_iovec(VirtIODevice *vdev, struct iovec *sg,
1295 hwaddr *addr, unsigned int num_sg,
1296 int is_write)
1297 {
1298 unsigned int i;
1299 hwaddr len;
1300
1301 for (i = 0; i < num_sg; i++) {
1302 len = sg[i].iov_len;
1303 sg[i].iov_base = dma_memory_map(vdev->dma_as,
1304 addr[i], &len, is_write ?
1305 DMA_DIRECTION_FROM_DEVICE :
1306 DMA_DIRECTION_TO_DEVICE);
1307 if (!sg[i].iov_base) {
1308 error_report("virtio: error trying to map MMIO memory");
1309 exit(1);
1310 }
1311 if (len != sg[i].iov_len) {
1312 error_report("virtio: unexpected memory split");
1313 exit(1);
1314 }
1315 }
1316 }
1317
1318 void virtqueue_map(VirtIODevice *vdev, VirtQueueElement *elem)
1319 {
1320 virtqueue_map_iovec(vdev, elem->in_sg, elem->in_addr, elem->in_num, 1);
1321 virtqueue_map_iovec(vdev, elem->out_sg, elem->out_addr, elem->out_num, 0);
1322 }
1323
1324 static void *virtqueue_alloc_element(size_t sz, unsigned out_num, unsigned in_num)
1325 {
1326 VirtQueueElement *elem;
1327 size_t in_addr_ofs = QEMU_ALIGN_UP(sz, __alignof__(elem->in_addr[0]));
1328 size_t out_addr_ofs = in_addr_ofs + in_num * sizeof(elem->in_addr[0]);
1329 size_t out_addr_end = out_addr_ofs + out_num * sizeof(elem->out_addr[0]);
1330 size_t in_sg_ofs = QEMU_ALIGN_UP(out_addr_end, __alignof__(elem->in_sg[0]));
1331 size_t out_sg_ofs = in_sg_ofs + in_num * sizeof(elem->in_sg[0]);
1332 size_t out_sg_end = out_sg_ofs + out_num * sizeof(elem->out_sg[0]);
1333
1334 assert(sz >= sizeof(VirtQueueElement));
1335 elem = g_malloc(out_sg_end);
1336 trace_virtqueue_alloc_element(elem, sz, in_num, out_num);
1337 elem->out_num = out_num;
1338 elem->in_num = in_num;
1339 elem->in_addr = (void *)elem + in_addr_ofs;
1340 elem->out_addr = (void *)elem + out_addr_ofs;
1341 elem->in_sg = (void *)elem + in_sg_ofs;
1342 elem->out_sg = (void *)elem + out_sg_ofs;
1343 return elem;
1344 }
1345
1346 static void *virtqueue_split_pop(VirtQueue *vq, size_t sz)
1347 {
1348 unsigned int i, head, max;
1349 VRingMemoryRegionCaches *caches;
1350 MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
1351 MemoryRegionCache *desc_cache;
1352 int64_t len;
1353 VirtIODevice *vdev = vq->vdev;
1354 VirtQueueElement *elem = NULL;
1355 unsigned out_num, in_num, elem_entries;
1356 hwaddr addr[VIRTQUEUE_MAX_SIZE];
1357 struct iovec iov[VIRTQUEUE_MAX_SIZE];
1358 VRingDesc desc;
1359 int rc;
1360
1361 RCU_READ_LOCK_GUARD();
1362 if (virtio_queue_empty_rcu(vq)) {
1363 goto done;
1364 }
1365 /* Needed after virtio_queue_empty(), see comment in
1366 * virtqueue_num_heads(). */
1367 smp_rmb();
1368
1369 /* When we start there are none of either input nor output. */
1370 out_num = in_num = elem_entries = 0;
1371
1372 max = vq->vring.num;
1373
1374 if (vq->inuse >= vq->vring.num) {
1375 virtio_error(vdev, "Virtqueue size exceeded");
1376 goto done;
1377 }
1378
1379 if (!virtqueue_get_head(vq, vq->last_avail_idx++, &head)) {
1380 goto done;
1381 }
1382
1383 if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
1384 vring_set_avail_event(vq, vq->last_avail_idx);
1385 }
1386
1387 i = head;
1388
1389 caches = vring_get_region_caches(vq);
1390 if (caches->desc.len < max * sizeof(VRingDesc)) {
1391 virtio_error(vdev, "Cannot map descriptor ring");
1392 goto done;
1393 }
1394
1395 desc_cache = &caches->desc;
1396 vring_split_desc_read(vdev, &desc, desc_cache, i);
1397 if (desc.flags & VRING_DESC_F_INDIRECT) {
1398 if (!desc.len || (desc.len % sizeof(VRingDesc))) {
1399 virtio_error(vdev, "Invalid size for indirect buffer table");
1400 goto done;
1401 }
1402
1403 /* loop over the indirect descriptor table */
1404 len = address_space_cache_init(&indirect_desc_cache, vdev->dma_as,
1405 desc.addr, desc.len, false);
1406 desc_cache = &indirect_desc_cache;
1407 if (len < desc.len) {
1408 virtio_error(vdev, "Cannot map indirect buffer");
1409 goto done;
1410 }
1411
1412 max = desc.len / sizeof(VRingDesc);
1413 i = 0;
1414 vring_split_desc_read(vdev, &desc, desc_cache, i);
1415 }
1416
1417 /* Collect all the descriptors */
1418 do {
1419 bool map_ok;
1420
1421 if (desc.flags & VRING_DESC_F_WRITE) {
1422 map_ok = virtqueue_map_desc(vdev, &in_num, addr + out_num,
1423 iov + out_num,
1424 VIRTQUEUE_MAX_SIZE - out_num, true,
1425 desc.addr, desc.len);
1426 } else {
1427 if (in_num) {
1428 virtio_error(vdev, "Incorrect order for descriptors");
1429 goto err_undo_map;
1430 }
1431 map_ok = virtqueue_map_desc(vdev, &out_num, addr, iov,
1432 VIRTQUEUE_MAX_SIZE, false,
1433 desc.addr, desc.len);
1434 }
1435 if (!map_ok) {
1436 goto err_undo_map;
1437 }
1438
1439 /* If we've got too many, that implies a descriptor loop. */
1440 if (++elem_entries > max) {
1441 virtio_error(vdev, "Looped descriptor");
1442 goto err_undo_map;
1443 }
1444
1445 rc = virtqueue_split_read_next_desc(vdev, &desc, desc_cache, max, &i);
1446 } while (rc == VIRTQUEUE_READ_DESC_MORE);
1447
1448 if (rc == VIRTQUEUE_READ_DESC_ERROR) {
1449 goto err_undo_map;
1450 }
1451
1452 /* Now copy what we have collected and mapped */
1453 elem = virtqueue_alloc_element(sz, out_num, in_num);
1454 elem->index = head;
1455 elem->ndescs = 1;
1456 for (i = 0; i < out_num; i++) {
1457 elem->out_addr[i] = addr[i];
1458 elem->out_sg[i] = iov[i];
1459 }
1460 for (i = 0; i < in_num; i++) {
1461 elem->in_addr[i] = addr[out_num + i];
1462 elem->in_sg[i] = iov[out_num + i];
1463 }
1464
1465 vq->inuse++;
1466
1467 trace_virtqueue_pop(vq, elem, elem->in_num, elem->out_num);
1468 done:
1469 address_space_cache_destroy(&indirect_desc_cache);
1470
1471 return elem;
1472
1473 err_undo_map:
1474 virtqueue_undo_map_desc(out_num, in_num, iov);
1475 goto done;
1476 }
1477
1478 static void *virtqueue_packed_pop(VirtQueue *vq, size_t sz)
1479 {
1480 unsigned int i, max;
1481 VRingMemoryRegionCaches *caches;
1482 MemoryRegionCache indirect_desc_cache = MEMORY_REGION_CACHE_INVALID;
1483 MemoryRegionCache *desc_cache;
1484 int64_t len;
1485 VirtIODevice *vdev = vq->vdev;
1486 VirtQueueElement *elem = NULL;
1487 unsigned out_num, in_num, elem_entries;
1488 hwaddr addr[VIRTQUEUE_MAX_SIZE];
1489 struct iovec iov[VIRTQUEUE_MAX_SIZE];
1490 VRingPackedDesc desc;
1491 uint16_t id;
1492 int rc;
1493
1494 RCU_READ_LOCK_GUARD();
1495 if (virtio_queue_packed_empty_rcu(vq)) {
1496 goto done;
1497 }
1498
1499 /* When we start there are none of either input nor output. */
1500 out_num = in_num = elem_entries = 0;
1501
1502 max = vq->vring.num;
1503
1504 if (vq->inuse >= vq->vring.num) {
1505 virtio_error(vdev, "Virtqueue size exceeded");
1506 goto done;
1507 }
1508
1509 i = vq->last_avail_idx;
1510
1511 caches = vring_get_region_caches(vq);
1512 if (caches->desc.len < max * sizeof(VRingDesc)) {
1513 virtio_error(vdev, "Cannot map descriptor ring");
1514 goto done;
1515 }
1516
1517 desc_cache = &caches->desc;
1518 vring_packed_desc_read(vdev, &desc, desc_cache, i, true);
1519 id = desc.id;
1520 if (desc.flags & VRING_DESC_F_INDIRECT) {
1521 if (desc.len % sizeof(VRingPackedDesc)) {
1522 virtio_error(vdev, "Invalid size for indirect buffer table");
1523 goto done;
1524 }
1525
1526 /* loop over the indirect descriptor table */
1527 len = address_space_cache_init(&indirect_desc_cache, vdev->dma_as,
1528 desc.addr, desc.len, false);
1529 desc_cache = &indirect_desc_cache;
1530 if (len < desc.len) {
1531 virtio_error(vdev, "Cannot map indirect buffer");
1532 goto done;
1533 }
1534
1535 max = desc.len / sizeof(VRingPackedDesc);
1536 i = 0;
1537 vring_packed_desc_read(vdev, &desc, desc_cache, i, false);
1538 }
1539
1540 /* Collect all the descriptors */
1541 do {
1542 bool map_ok;
1543
1544 if (desc.flags & VRING_DESC_F_WRITE) {
1545 map_ok = virtqueue_map_desc(vdev, &in_num, addr + out_num,
1546 iov + out_num,
1547 VIRTQUEUE_MAX_SIZE - out_num, true,
1548 desc.addr, desc.len);
1549 } else {
1550 if (in_num) {
1551 virtio_error(vdev, "Incorrect order for descriptors");
1552 goto err_undo_map;
1553 }
1554 map_ok = virtqueue_map_desc(vdev, &out_num, addr, iov,
1555 VIRTQUEUE_MAX_SIZE, false,
1556 desc.addr, desc.len);
1557 }
1558 if (!map_ok) {
1559 goto err_undo_map;
1560 }
1561
1562 /* If we've got too many, that implies a descriptor loop. */
1563 if (++elem_entries > max) {
1564 virtio_error(vdev, "Looped descriptor");
1565 goto err_undo_map;
1566 }
1567
1568 rc = virtqueue_packed_read_next_desc(vq, &desc, desc_cache, max, &i,
1569 desc_cache ==
1570 &indirect_desc_cache);
1571 } while (rc == VIRTQUEUE_READ_DESC_MORE);
1572
1573 /* Now copy what we have collected and mapped */
1574 elem = virtqueue_alloc_element(sz, out_num, in_num);
1575 for (i = 0; i < out_num; i++) {
1576 elem->out_addr[i] = addr[i];
1577 elem->out_sg[i] = iov[i];
1578 }
1579 for (i = 0; i < in_num; i++) {
1580 elem->in_addr[i] = addr[out_num + i];
1581 elem->in_sg[i] = iov[out_num + i];
1582 }
1583
1584 elem->index = id;
1585 elem->ndescs = (desc_cache == &indirect_desc_cache) ? 1 : elem_entries;
1586 vq->last_avail_idx += elem->ndescs;
1587 vq->inuse += elem->ndescs;
1588
1589 if (vq->last_avail_idx >= vq->vring.num) {
1590 vq->last_avail_idx -= vq->vring.num;
1591 vq->last_avail_wrap_counter ^= 1;
1592 }
1593
1594 vq->shadow_avail_idx = vq->last_avail_idx;
1595 vq->shadow_avail_wrap_counter = vq->last_avail_wrap_counter;
1596
1597 trace_virtqueue_pop(vq, elem, elem->in_num, elem->out_num);
1598 done:
1599 address_space_cache_destroy(&indirect_desc_cache);
1600
1601 return elem;
1602
1603 err_undo_map:
1604 virtqueue_undo_map_desc(out_num, in_num, iov);
1605 goto done;
1606 }
1607
1608 void *virtqueue_pop(VirtQueue *vq, size_t sz)
1609 {
1610 if (virtio_device_disabled(vq->vdev)) {
1611 return NULL;
1612 }
1613
1614 if (virtio_vdev_has_feature(vq->vdev, VIRTIO_F_RING_PACKED)) {
1615 return virtqueue_packed_pop(vq, sz);
1616 } else {
1617 return virtqueue_split_pop(vq, sz);
1618 }
1619 }
1620
1621 static unsigned int virtqueue_packed_drop_all(VirtQueue *vq)
1622 {
1623 VRingMemoryRegionCaches *caches;
1624 MemoryRegionCache *desc_cache;
1625 unsigned int dropped = 0;
1626 VirtQueueElement elem = {};
1627 VirtIODevice *vdev = vq->vdev;
1628 VRingPackedDesc desc;
1629
1630 caches = vring_get_region_caches(vq);
1631 desc_cache = &caches->desc;
1632
1633 virtio_queue_set_notification(vq, 0);
1634
1635 while (vq->inuse < vq->vring.num) {
1636 unsigned int idx = vq->last_avail_idx;
1637 /*
1638 * works similar to virtqueue_pop but does not map buffers
1639 * and does not allocate any memory.
1640 */
1641 vring_packed_desc_read(vdev, &desc, desc_cache,
1642 vq->last_avail_idx , true);
1643 if (!is_desc_avail(desc.flags, vq->last_avail_wrap_counter)) {
1644 break;
1645 }
1646 elem.index = desc.id;
1647 elem.ndescs = 1;
1648 while (virtqueue_packed_read_next_desc(vq, &desc, desc_cache,
1649 vq->vring.num, &idx, false)) {
1650 ++elem.ndescs;
1651 }
1652 /*
1653 * immediately push the element, nothing to unmap
1654 * as both in_num and out_num are set to 0.
1655 */
1656 virtqueue_push(vq, &elem, 0);
1657 dropped++;
1658 vq->last_avail_idx += elem.ndescs;
1659 if (vq->last_avail_idx >= vq->vring.num) {
1660 vq->last_avail_idx -= vq->vring.num;
1661 vq->last_avail_wrap_counter ^= 1;
1662 }
1663 }
1664
1665 return dropped;
1666 }
1667
1668 static unsigned int virtqueue_split_drop_all(VirtQueue *vq)
1669 {
1670 unsigned int dropped = 0;
1671 VirtQueueElement elem = {};
1672 VirtIODevice *vdev = vq->vdev;
1673 bool fEventIdx = virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX);
1674
1675 while (!virtio_queue_empty(vq) && vq->inuse < vq->vring.num) {
1676 /* works similar to virtqueue_pop but does not map buffers
1677 * and does not allocate any memory */
1678 smp_rmb();
1679 if (!virtqueue_get_head(vq, vq->last_avail_idx, &elem.index)) {
1680 break;
1681 }
1682 vq->inuse++;
1683 vq->last_avail_idx++;
1684 if (fEventIdx) {
1685 vring_set_avail_event(vq, vq->last_avail_idx);
1686 }
1687 /* immediately push the element, nothing to unmap
1688 * as both in_num and out_num are set to 0 */
1689 virtqueue_push(vq, &elem, 0);
1690 dropped++;
1691 }
1692
1693 return dropped;
1694 }
1695
1696 /* virtqueue_drop_all:
1697 * @vq: The #VirtQueue
1698 * Drops all queued buffers and indicates them to the guest
1699 * as if they are done. Useful when buffers can not be
1700 * processed but must be returned to the guest.
1701 */
1702 unsigned int virtqueue_drop_all(VirtQueue *vq)
1703 {
1704 struct VirtIODevice *vdev = vq->vdev;
1705
1706 if (virtio_device_disabled(vq->vdev)) {
1707 return 0;
1708 }
1709
1710 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
1711 return virtqueue_packed_drop_all(vq);
1712 } else {
1713 return virtqueue_split_drop_all(vq);
1714 }
1715 }
1716
1717 /* Reading and writing a structure directly to QEMUFile is *awful*, but
1718 * it is what QEMU has always done by mistake. We can change it sooner
1719 * or later by bumping the version number of the affected vm states.
1720 * In the meanwhile, since the in-memory layout of VirtQueueElement
1721 * has changed, we need to marshal to and from the layout that was
1722 * used before the change.
1723 */
1724 typedef struct VirtQueueElementOld {
1725 unsigned int index;
1726 unsigned int out_num;
1727 unsigned int in_num;
1728 hwaddr in_addr[VIRTQUEUE_MAX_SIZE];
1729 hwaddr out_addr[VIRTQUEUE_MAX_SIZE];
1730 struct iovec in_sg[VIRTQUEUE_MAX_SIZE];
1731 struct iovec out_sg[VIRTQUEUE_MAX_SIZE];
1732 } VirtQueueElementOld;
1733
1734 void *qemu_get_virtqueue_element(VirtIODevice *vdev, QEMUFile *f, size_t sz)
1735 {
1736 VirtQueueElement *elem;
1737 VirtQueueElementOld data;
1738 int i;
1739
1740 qemu_get_buffer(f, (uint8_t *)&data, sizeof(VirtQueueElementOld));
1741
1742 /* TODO: teach all callers that this can fail, and return failure instead
1743 * of asserting here.
1744 * This is just one thing (there are probably more) that must be
1745 * fixed before we can allow NDEBUG compilation.
1746 */
1747 assert(ARRAY_SIZE(data.in_addr) >= data.in_num);
1748 assert(ARRAY_SIZE(data.out_addr) >= data.out_num);
1749
1750 elem = virtqueue_alloc_element(sz, data.out_num, data.in_num);
1751 elem->index = data.index;
1752
1753 for (i = 0; i < elem->in_num; i++) {
1754 elem->in_addr[i] = data.in_addr[i];
1755 }
1756
1757 for (i = 0; i < elem->out_num; i++) {
1758 elem->out_addr[i] = data.out_addr[i];
1759 }
1760
1761 for (i = 0; i < elem->in_num; i++) {
1762 /* Base is overwritten by virtqueue_map. */
1763 elem->in_sg[i].iov_base = 0;
1764 elem->in_sg[i].iov_len = data.in_sg[i].iov_len;
1765 }
1766
1767 for (i = 0; i < elem->out_num; i++) {
1768 /* Base is overwritten by virtqueue_map. */
1769 elem->out_sg[i].iov_base = 0;
1770 elem->out_sg[i].iov_len = data.out_sg[i].iov_len;
1771 }
1772
1773 if (virtio_host_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
1774 qemu_get_be32s(f, &elem->ndescs);
1775 }
1776
1777 virtqueue_map(vdev, elem);
1778 return elem;
1779 }
1780
1781 void qemu_put_virtqueue_element(VirtIODevice *vdev, QEMUFile *f,
1782 VirtQueueElement *elem)
1783 {
1784 VirtQueueElementOld data;
1785 int i;
1786
1787 memset(&data, 0, sizeof(data));
1788 data.index = elem->index;
1789 data.in_num = elem->in_num;
1790 data.out_num = elem->out_num;
1791
1792 for (i = 0; i < elem->in_num; i++) {
1793 data.in_addr[i] = elem->in_addr[i];
1794 }
1795
1796 for (i = 0; i < elem->out_num; i++) {
1797 data.out_addr[i] = elem->out_addr[i];
1798 }
1799
1800 for (i = 0; i < elem->in_num; i++) {
1801 /* Base is overwritten by virtqueue_map when loading. Do not
1802 * save it, as it would leak the QEMU address space layout. */
1803 data.in_sg[i].iov_len = elem->in_sg[i].iov_len;
1804 }
1805
1806 for (i = 0; i < elem->out_num; i++) {
1807 /* Do not save iov_base as above. */
1808 data.out_sg[i].iov_len = elem->out_sg[i].iov_len;
1809 }
1810
1811 if (virtio_host_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
1812 qemu_put_be32s(f, &elem->ndescs);
1813 }
1814
1815 qemu_put_buffer(f, (uint8_t *)&data, sizeof(VirtQueueElementOld));
1816 }
1817
1818 /* virtio device */
1819 static void virtio_notify_vector(VirtIODevice *vdev, uint16_t vector)
1820 {
1821 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
1822 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
1823
1824 if (virtio_device_disabled(vdev)) {
1825 return;
1826 }
1827
1828 if (k->notify) {
1829 k->notify(qbus->parent, vector);
1830 }
1831 }
1832
1833 void virtio_update_irq(VirtIODevice *vdev)
1834 {
1835 virtio_notify_vector(vdev, VIRTIO_NO_VECTOR);
1836 }
1837
1838 static int virtio_validate_features(VirtIODevice *vdev)
1839 {
1840 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1841
1842 if (virtio_host_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM) &&
1843 !virtio_vdev_has_feature(vdev, VIRTIO_F_IOMMU_PLATFORM)) {
1844 return -EFAULT;
1845 }
1846
1847 if (k->validate_features) {
1848 return k->validate_features(vdev);
1849 } else {
1850 return 0;
1851 }
1852 }
1853
1854 int virtio_set_status(VirtIODevice *vdev, uint8_t val)
1855 {
1856 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1857 trace_virtio_set_status(vdev, val);
1858
1859 if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
1860 if (!(vdev->status & VIRTIO_CONFIG_S_FEATURES_OK) &&
1861 val & VIRTIO_CONFIG_S_FEATURES_OK) {
1862 int ret = virtio_validate_features(vdev);
1863
1864 if (ret) {
1865 return ret;
1866 }
1867 }
1868 }
1869
1870 if ((vdev->status & VIRTIO_CONFIG_S_DRIVER_OK) !=
1871 (val & VIRTIO_CONFIG_S_DRIVER_OK)) {
1872 virtio_set_started(vdev, val & VIRTIO_CONFIG_S_DRIVER_OK);
1873 }
1874
1875 if (k->set_status) {
1876 k->set_status(vdev, val);
1877 }
1878 vdev->status = val;
1879
1880 return 0;
1881 }
1882
1883 static enum virtio_device_endian virtio_default_endian(void)
1884 {
1885 if (target_words_bigendian()) {
1886 return VIRTIO_DEVICE_ENDIAN_BIG;
1887 } else {
1888 return VIRTIO_DEVICE_ENDIAN_LITTLE;
1889 }
1890 }
1891
1892 static enum virtio_device_endian virtio_current_cpu_endian(void)
1893 {
1894 CPUClass *cc = CPU_GET_CLASS(current_cpu);
1895
1896 if (cc->virtio_is_big_endian(current_cpu)) {
1897 return VIRTIO_DEVICE_ENDIAN_BIG;
1898 } else {
1899 return VIRTIO_DEVICE_ENDIAN_LITTLE;
1900 }
1901 }
1902
1903 void virtio_reset(void *opaque)
1904 {
1905 VirtIODevice *vdev = opaque;
1906 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1907 int i;
1908
1909 virtio_set_status(vdev, 0);
1910 if (current_cpu) {
1911 /* Guest initiated reset */
1912 vdev->device_endian = virtio_current_cpu_endian();
1913 } else {
1914 /* System reset */
1915 vdev->device_endian = virtio_default_endian();
1916 }
1917
1918 if (k->reset) {
1919 k->reset(vdev);
1920 }
1921
1922 vdev->start_on_kick = false;
1923 vdev->started = false;
1924 vdev->broken = false;
1925 vdev->guest_features = 0;
1926 vdev->queue_sel = 0;
1927 vdev->status = 0;
1928 vdev->disabled = false;
1929 atomic_set(&vdev->isr, 0);
1930 vdev->config_vector = VIRTIO_NO_VECTOR;
1931 virtio_notify_vector(vdev, vdev->config_vector);
1932
1933 for(i = 0; i < VIRTIO_QUEUE_MAX; i++) {
1934 vdev->vq[i].vring.desc = 0;
1935 vdev->vq[i].vring.avail = 0;
1936 vdev->vq[i].vring.used = 0;
1937 vdev->vq[i].last_avail_idx = 0;
1938 vdev->vq[i].shadow_avail_idx = 0;
1939 vdev->vq[i].used_idx = 0;
1940 vdev->vq[i].last_avail_wrap_counter = true;
1941 vdev->vq[i].shadow_avail_wrap_counter = true;
1942 vdev->vq[i].used_wrap_counter = true;
1943 virtio_queue_set_vector(vdev, i, VIRTIO_NO_VECTOR);
1944 vdev->vq[i].signalled_used = 0;
1945 vdev->vq[i].signalled_used_valid = false;
1946 vdev->vq[i].notification = true;
1947 vdev->vq[i].vring.num = vdev->vq[i].vring.num_default;
1948 vdev->vq[i].inuse = 0;
1949 virtio_virtqueue_reset_region_cache(&vdev->vq[i]);
1950 }
1951 }
1952
1953 uint32_t virtio_config_readb(VirtIODevice *vdev, uint32_t addr)
1954 {
1955 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1956 uint8_t val;
1957
1958 if (addr + sizeof(val) > vdev->config_len) {
1959 return (uint32_t)-1;
1960 }
1961
1962 k->get_config(vdev, vdev->config);
1963
1964 val = ldub_p(vdev->config + addr);
1965 return val;
1966 }
1967
1968 uint32_t virtio_config_readw(VirtIODevice *vdev, uint32_t addr)
1969 {
1970 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1971 uint16_t val;
1972
1973 if (addr + sizeof(val) > vdev->config_len) {
1974 return (uint32_t)-1;
1975 }
1976
1977 k->get_config(vdev, vdev->config);
1978
1979 val = lduw_p(vdev->config + addr);
1980 return val;
1981 }
1982
1983 uint32_t virtio_config_readl(VirtIODevice *vdev, uint32_t addr)
1984 {
1985 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
1986 uint32_t val;
1987
1988 if (addr + sizeof(val) > vdev->config_len) {
1989 return (uint32_t)-1;
1990 }
1991
1992 k->get_config(vdev, vdev->config);
1993
1994 val = ldl_p(vdev->config + addr);
1995 return val;
1996 }
1997
1998 void virtio_config_writeb(VirtIODevice *vdev, uint32_t addr, uint32_t data)
1999 {
2000 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2001 uint8_t val = data;
2002
2003 if (addr + sizeof(val) > vdev->config_len) {
2004 return;
2005 }
2006
2007 stb_p(vdev->config + addr, val);
2008
2009 if (k->set_config) {
2010 k->set_config(vdev, vdev->config);
2011 }
2012 }
2013
2014 void virtio_config_writew(VirtIODevice *vdev, uint32_t addr, uint32_t data)
2015 {
2016 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2017 uint16_t val = data;
2018
2019 if (addr + sizeof(val) > vdev->config_len) {
2020 return;
2021 }
2022
2023 stw_p(vdev->config + addr, val);
2024
2025 if (k->set_config) {
2026 k->set_config(vdev, vdev->config);
2027 }
2028 }
2029
2030 void virtio_config_writel(VirtIODevice *vdev, uint32_t addr, uint32_t data)
2031 {
2032 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2033 uint32_t val = data;
2034
2035 if (addr + sizeof(val) > vdev->config_len) {
2036 return;
2037 }
2038
2039 stl_p(vdev->config + addr, val);
2040
2041 if (k->set_config) {
2042 k->set_config(vdev, vdev->config);
2043 }
2044 }
2045
2046 uint32_t virtio_config_modern_readb(VirtIODevice *vdev, uint32_t addr)
2047 {
2048 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2049 uint8_t val;
2050
2051 if (addr + sizeof(val) > vdev->config_len) {
2052 return (uint32_t)-1;
2053 }
2054
2055 k->get_config(vdev, vdev->config);
2056
2057 val = ldub_p(vdev->config + addr);
2058 return val;
2059 }
2060
2061 uint32_t virtio_config_modern_readw(VirtIODevice *vdev, uint32_t addr)
2062 {
2063 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2064 uint16_t val;
2065
2066 if (addr + sizeof(val) > vdev->config_len) {
2067 return (uint32_t)-1;
2068 }
2069
2070 k->get_config(vdev, vdev->config);
2071
2072 val = lduw_le_p(vdev->config + addr);
2073 return val;
2074 }
2075
2076 uint32_t virtio_config_modern_readl(VirtIODevice *vdev, uint32_t addr)
2077 {
2078 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2079 uint32_t val;
2080
2081 if (addr + sizeof(val) > vdev->config_len) {
2082 return (uint32_t)-1;
2083 }
2084
2085 k->get_config(vdev, vdev->config);
2086
2087 val = ldl_le_p(vdev->config + addr);
2088 return val;
2089 }
2090
2091 void virtio_config_modern_writeb(VirtIODevice *vdev,
2092 uint32_t addr, uint32_t data)
2093 {
2094 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2095 uint8_t val = data;
2096
2097 if (addr + sizeof(val) > vdev->config_len) {
2098 return;
2099 }
2100
2101 stb_p(vdev->config + addr, val);
2102
2103 if (k->set_config) {
2104 k->set_config(vdev, vdev->config);
2105 }
2106 }
2107
2108 void virtio_config_modern_writew(VirtIODevice *vdev,
2109 uint32_t addr, uint32_t data)
2110 {
2111 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2112 uint16_t val = data;
2113
2114 if (addr + sizeof(val) > vdev->config_len) {
2115 return;
2116 }
2117
2118 stw_le_p(vdev->config + addr, val);
2119
2120 if (k->set_config) {
2121 k->set_config(vdev, vdev->config);
2122 }
2123 }
2124
2125 void virtio_config_modern_writel(VirtIODevice *vdev,
2126 uint32_t addr, uint32_t data)
2127 {
2128 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2129 uint32_t val = data;
2130
2131 if (addr + sizeof(val) > vdev->config_len) {
2132 return;
2133 }
2134
2135 stl_le_p(vdev->config + addr, val);
2136
2137 if (k->set_config) {
2138 k->set_config(vdev, vdev->config);
2139 }
2140 }
2141
2142 void virtio_queue_set_addr(VirtIODevice *vdev, int n, hwaddr addr)
2143 {
2144 if (!vdev->vq[n].vring.num) {
2145 return;
2146 }
2147 vdev->vq[n].vring.desc = addr;
2148 virtio_queue_update_rings(vdev, n);
2149 }
2150
2151 hwaddr virtio_queue_get_addr(VirtIODevice *vdev, int n)
2152 {
2153 return vdev->vq[n].vring.desc;
2154 }
2155
2156 void virtio_queue_set_rings(VirtIODevice *vdev, int n, hwaddr desc,
2157 hwaddr avail, hwaddr used)
2158 {
2159 if (!vdev->vq[n].vring.num) {
2160 return;
2161 }
2162 vdev->vq[n].vring.desc = desc;
2163 vdev->vq[n].vring.avail = avail;
2164 vdev->vq[n].vring.used = used;
2165 virtio_init_region_cache(vdev, n);
2166 }
2167
2168 void virtio_queue_set_num(VirtIODevice *vdev, int n, int num)
2169 {
2170 /* Don't allow guest to flip queue between existent and
2171 * nonexistent states, or to set it to an invalid size.
2172 */
2173 if (!!num != !!vdev->vq[n].vring.num ||
2174 num > VIRTQUEUE_MAX_SIZE ||
2175 num < 0) {
2176 return;
2177 }
2178 vdev->vq[n].vring.num = num;
2179 }
2180
2181 VirtQueue *virtio_vector_first_queue(VirtIODevice *vdev, uint16_t vector)
2182 {
2183 return QLIST_FIRST(&vdev->vector_queues[vector]);
2184 }
2185
2186 VirtQueue *virtio_vector_next_queue(VirtQueue *vq)
2187 {
2188 return QLIST_NEXT(vq, node);
2189 }
2190
2191 int virtio_queue_get_num(VirtIODevice *vdev, int n)
2192 {
2193 return vdev->vq[n].vring.num;
2194 }
2195
2196 int virtio_queue_get_max_num(VirtIODevice *vdev, int n)
2197 {
2198 return vdev->vq[n].vring.num_default;
2199 }
2200
2201 int virtio_get_num_queues(VirtIODevice *vdev)
2202 {
2203 int i;
2204
2205 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2206 if (!virtio_queue_get_num(vdev, i)) {
2207 break;
2208 }
2209 }
2210
2211 return i;
2212 }
2213
2214 void virtio_queue_set_align(VirtIODevice *vdev, int n, int align)
2215 {
2216 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2217 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2218
2219 /* virtio-1 compliant devices cannot change the alignment */
2220 if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
2221 error_report("tried to modify queue alignment for virtio-1 device");
2222 return;
2223 }
2224 /* Check that the transport told us it was going to do this
2225 * (so a buggy transport will immediately assert rather than
2226 * silently failing to migrate this state)
2227 */
2228 assert(k->has_variable_vring_alignment);
2229
2230 if (align) {
2231 vdev->vq[n].vring.align = align;
2232 virtio_queue_update_rings(vdev, n);
2233 }
2234 }
2235
2236 static bool virtio_queue_notify_aio_vq(VirtQueue *vq)
2237 {
2238 bool ret = false;
2239
2240 if (vq->vring.desc && vq->handle_aio_output) {
2241 VirtIODevice *vdev = vq->vdev;
2242
2243 trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
2244 ret = vq->handle_aio_output(vdev, vq);
2245
2246 if (unlikely(vdev->start_on_kick)) {
2247 virtio_set_started(vdev, true);
2248 }
2249 }
2250
2251 return ret;
2252 }
2253
2254 static void virtio_queue_notify_vq(VirtQueue *vq)
2255 {
2256 if (vq->vring.desc && vq->handle_output) {
2257 VirtIODevice *vdev = vq->vdev;
2258
2259 if (unlikely(vdev->broken)) {
2260 return;
2261 }
2262
2263 trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
2264 vq->handle_output(vdev, vq);
2265
2266 if (unlikely(vdev->start_on_kick)) {
2267 virtio_set_started(vdev, true);
2268 }
2269 }
2270 }
2271
2272 void virtio_queue_notify(VirtIODevice *vdev, int n)
2273 {
2274 VirtQueue *vq = &vdev->vq[n];
2275
2276 if (unlikely(!vq->vring.desc || vdev->broken)) {
2277 return;
2278 }
2279
2280 trace_virtio_queue_notify(vdev, vq - vdev->vq, vq);
2281 if (vq->host_notifier_enabled) {
2282 event_notifier_set(&vq->host_notifier);
2283 } else if (vq->handle_output) {
2284 vq->handle_output(vdev, vq);
2285
2286 if (unlikely(vdev->start_on_kick)) {
2287 virtio_set_started(vdev, true);
2288 }
2289 }
2290 }
2291
2292 uint16_t virtio_queue_vector(VirtIODevice *vdev, int n)
2293 {
2294 return n < VIRTIO_QUEUE_MAX ? vdev->vq[n].vector :
2295 VIRTIO_NO_VECTOR;
2296 }
2297
2298 void virtio_queue_set_vector(VirtIODevice *vdev, int n, uint16_t vector)
2299 {
2300 VirtQueue *vq = &vdev->vq[n];
2301
2302 if (n < VIRTIO_QUEUE_MAX) {
2303 if (vdev->vector_queues &&
2304 vdev->vq[n].vector != VIRTIO_NO_VECTOR) {
2305 QLIST_REMOVE(vq, node);
2306 }
2307 vdev->vq[n].vector = vector;
2308 if (vdev->vector_queues &&
2309 vector != VIRTIO_NO_VECTOR) {
2310 QLIST_INSERT_HEAD(&vdev->vector_queues[vector], vq, node);
2311 }
2312 }
2313 }
2314
2315 VirtQueue *virtio_add_queue(VirtIODevice *vdev, int queue_size,
2316 VirtIOHandleOutput handle_output)
2317 {
2318 int i;
2319
2320 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2321 if (vdev->vq[i].vring.num == 0)
2322 break;
2323 }
2324
2325 if (i == VIRTIO_QUEUE_MAX || queue_size > VIRTQUEUE_MAX_SIZE)
2326 abort();
2327
2328 vdev->vq[i].vring.num = queue_size;
2329 vdev->vq[i].vring.num_default = queue_size;
2330 vdev->vq[i].vring.align = VIRTIO_PCI_VRING_ALIGN;
2331 vdev->vq[i].handle_output = handle_output;
2332 vdev->vq[i].handle_aio_output = NULL;
2333 vdev->vq[i].used_elems = g_malloc0(sizeof(VirtQueueElement) *
2334 queue_size);
2335
2336 return &vdev->vq[i];
2337 }
2338
2339 void virtio_delete_queue(VirtQueue *vq)
2340 {
2341 vq->vring.num = 0;
2342 vq->vring.num_default = 0;
2343 vq->handle_output = NULL;
2344 vq->handle_aio_output = NULL;
2345 g_free(vq->used_elems);
2346 vq->used_elems = NULL;
2347 }
2348
2349 void virtio_del_queue(VirtIODevice *vdev, int n)
2350 {
2351 if (n < 0 || n >= VIRTIO_QUEUE_MAX) {
2352 abort();
2353 }
2354
2355 virtio_delete_queue(&vdev->vq[n]);
2356 }
2357
2358 static void virtio_set_isr(VirtIODevice *vdev, int value)
2359 {
2360 uint8_t old = atomic_read(&vdev->isr);
2361
2362 /* Do not write ISR if it does not change, so that its cacheline remains
2363 * shared in the common case where the guest does not read it.
2364 */
2365 if ((old & value) != value) {
2366 atomic_or(&vdev->isr, value);
2367 }
2368 }
2369
2370 static bool virtio_split_should_notify(VirtIODevice *vdev, VirtQueue *vq)
2371 {
2372 uint16_t old, new;
2373 bool v;
2374 /* We need to expose used array entries before checking used event. */
2375 smp_mb();
2376 /* Always notify when queue is empty (when feature acknowledge) */
2377 if (virtio_vdev_has_feature(vdev, VIRTIO_F_NOTIFY_ON_EMPTY) &&
2378 !vq->inuse && virtio_queue_empty(vq)) {
2379 return true;
2380 }
2381
2382 if (!virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
2383 return !(vring_avail_flags(vq) & VRING_AVAIL_F_NO_INTERRUPT);
2384 }
2385
2386 v = vq->signalled_used_valid;
2387 vq->signalled_used_valid = true;
2388 old = vq->signalled_used;
2389 new = vq->signalled_used = vq->used_idx;
2390 return !v || vring_need_event(vring_get_used_event(vq), new, old);
2391 }
2392
2393 static bool vring_packed_need_event(VirtQueue *vq, bool wrap,
2394 uint16_t off_wrap, uint16_t new,
2395 uint16_t old)
2396 {
2397 int off = off_wrap & ~(1 << 15);
2398
2399 if (wrap != off_wrap >> 15) {
2400 off -= vq->vring.num;
2401 }
2402
2403 return vring_need_event(off, new, old);
2404 }
2405
2406 static bool virtio_packed_should_notify(VirtIODevice *vdev, VirtQueue *vq)
2407 {
2408 VRingPackedDescEvent e;
2409 uint16_t old, new;
2410 bool v;
2411 VRingMemoryRegionCaches *caches;
2412
2413 caches = vring_get_region_caches(vq);
2414 vring_packed_event_read(vdev, &caches->avail, &e);
2415
2416 old = vq->signalled_used;
2417 new = vq->signalled_used = vq->used_idx;
2418 v = vq->signalled_used_valid;
2419 vq->signalled_used_valid = true;
2420
2421 if (e.flags == VRING_PACKED_EVENT_FLAG_DISABLE) {
2422 return false;
2423 } else if (e.flags == VRING_PACKED_EVENT_FLAG_ENABLE) {
2424 return true;
2425 }
2426
2427 return !v || vring_packed_need_event(vq, vq->used_wrap_counter,
2428 e.off_wrap, new, old);
2429 }
2430
2431 /* Called within rcu_read_lock(). */
2432 static bool virtio_should_notify(VirtIODevice *vdev, VirtQueue *vq)
2433 {
2434 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
2435 return virtio_packed_should_notify(vdev, vq);
2436 } else {
2437 return virtio_split_should_notify(vdev, vq);
2438 }
2439 }
2440
2441 void virtio_notify_irqfd(VirtIODevice *vdev, VirtQueue *vq)
2442 {
2443 WITH_RCU_READ_LOCK_GUARD() {
2444 if (!virtio_should_notify(vdev, vq)) {
2445 return;
2446 }
2447 }
2448
2449 trace_virtio_notify_irqfd(vdev, vq);
2450
2451 /*
2452 * virtio spec 1.0 says ISR bit 0 should be ignored with MSI, but
2453 * windows drivers included in virtio-win 1.8.0 (circa 2015) are
2454 * incorrectly polling this bit during crashdump and hibernation
2455 * in MSI mode, causing a hang if this bit is never updated.
2456 * Recent releases of Windows do not really shut down, but rather
2457 * log out and hibernate to make the next startup faster. Hence,
2458 * this manifested as a more serious hang during shutdown with
2459 *
2460 * Next driver release from 2016 fixed this problem, so working around it
2461 * is not a must, but it's easy to do so let's do it here.
2462 *
2463 * Note: it's safe to update ISR from any thread as it was switched
2464 * to an atomic operation.
2465 */
2466 virtio_set_isr(vq->vdev, 0x1);
2467 event_notifier_set(&vq->guest_notifier);
2468 }
2469
2470 static void virtio_irq(VirtQueue *vq)
2471 {
2472 virtio_set_isr(vq->vdev, 0x1);
2473 virtio_notify_vector(vq->vdev, vq->vector);
2474 }
2475
2476 void virtio_notify(VirtIODevice *vdev, VirtQueue *vq)
2477 {
2478 WITH_RCU_READ_LOCK_GUARD() {
2479 if (!virtio_should_notify(vdev, vq)) {
2480 return;
2481 }
2482 }
2483
2484 trace_virtio_notify(vdev, vq);
2485 virtio_irq(vq);
2486 }
2487
2488 void virtio_notify_config(VirtIODevice *vdev)
2489 {
2490 if (!(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK))
2491 return;
2492
2493 virtio_set_isr(vdev, 0x3);
2494 vdev->generation++;
2495 virtio_notify_vector(vdev, vdev->config_vector);
2496 }
2497
2498 static bool virtio_device_endian_needed(void *opaque)
2499 {
2500 VirtIODevice *vdev = opaque;
2501
2502 assert(vdev->device_endian != VIRTIO_DEVICE_ENDIAN_UNKNOWN);
2503 if (!virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
2504 return vdev->device_endian != virtio_default_endian();
2505 }
2506 /* Devices conforming to VIRTIO 1.0 or later are always LE. */
2507 return vdev->device_endian != VIRTIO_DEVICE_ENDIAN_LITTLE;
2508 }
2509
2510 static bool virtio_64bit_features_needed(void *opaque)
2511 {
2512 VirtIODevice *vdev = opaque;
2513
2514 return (vdev->host_features >> 32) != 0;
2515 }
2516
2517 static bool virtio_virtqueue_needed(void *opaque)
2518 {
2519 VirtIODevice *vdev = opaque;
2520
2521 return virtio_host_has_feature(vdev, VIRTIO_F_VERSION_1);
2522 }
2523
2524 static bool virtio_packed_virtqueue_needed(void *opaque)
2525 {
2526 VirtIODevice *vdev = opaque;
2527
2528 return virtio_host_has_feature(vdev, VIRTIO_F_RING_PACKED);
2529 }
2530
2531 static bool virtio_ringsize_needed(void *opaque)
2532 {
2533 VirtIODevice *vdev = opaque;
2534 int i;
2535
2536 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2537 if (vdev->vq[i].vring.num != vdev->vq[i].vring.num_default) {
2538 return true;
2539 }
2540 }
2541 return false;
2542 }
2543
2544 static bool virtio_extra_state_needed(void *opaque)
2545 {
2546 VirtIODevice *vdev = opaque;
2547 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2548 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2549
2550 return k->has_extra_state &&
2551 k->has_extra_state(qbus->parent);
2552 }
2553
2554 static bool virtio_broken_needed(void *opaque)
2555 {
2556 VirtIODevice *vdev = opaque;
2557
2558 return vdev->broken;
2559 }
2560
2561 static bool virtio_started_needed(void *opaque)
2562 {
2563 VirtIODevice *vdev = opaque;
2564
2565 return vdev->started;
2566 }
2567
2568 static bool virtio_disabled_needed(void *opaque)
2569 {
2570 VirtIODevice *vdev = opaque;
2571
2572 return vdev->disabled;
2573 }
2574
2575 static const VMStateDescription vmstate_virtqueue = {
2576 .name = "virtqueue_state",
2577 .version_id = 1,
2578 .minimum_version_id = 1,
2579 .fields = (VMStateField[]) {
2580 VMSTATE_UINT64(vring.avail, struct VirtQueue),
2581 VMSTATE_UINT64(vring.used, struct VirtQueue),
2582 VMSTATE_END_OF_LIST()
2583 }
2584 };
2585
2586 static const VMStateDescription vmstate_packed_virtqueue = {
2587 .name = "packed_virtqueue_state",
2588 .version_id = 1,
2589 .minimum_version_id = 1,
2590 .fields = (VMStateField[]) {
2591 VMSTATE_UINT16(last_avail_idx, struct VirtQueue),
2592 VMSTATE_BOOL(last_avail_wrap_counter, struct VirtQueue),
2593 VMSTATE_UINT16(used_idx, struct VirtQueue),
2594 VMSTATE_BOOL(used_wrap_counter, struct VirtQueue),
2595 VMSTATE_UINT32(inuse, struct VirtQueue),
2596 VMSTATE_END_OF_LIST()
2597 }
2598 };
2599
2600 static const VMStateDescription vmstate_virtio_virtqueues = {
2601 .name = "virtio/virtqueues",
2602 .version_id = 1,
2603 .minimum_version_id = 1,
2604 .needed = &virtio_virtqueue_needed,
2605 .fields = (VMStateField[]) {
2606 VMSTATE_STRUCT_VARRAY_POINTER_KNOWN(vq, struct VirtIODevice,
2607 VIRTIO_QUEUE_MAX, 0, vmstate_virtqueue, VirtQueue),
2608 VMSTATE_END_OF_LIST()
2609 }
2610 };
2611
2612 static const VMStateDescription vmstate_virtio_packed_virtqueues = {
2613 .name = "virtio/packed_virtqueues",
2614 .version_id = 1,
2615 .minimum_version_id = 1,
2616 .needed = &virtio_packed_virtqueue_needed,
2617 .fields = (VMStateField[]) {
2618 VMSTATE_STRUCT_VARRAY_POINTER_KNOWN(vq, struct VirtIODevice,
2619 VIRTIO_QUEUE_MAX, 0, vmstate_packed_virtqueue, VirtQueue),
2620 VMSTATE_END_OF_LIST()
2621 }
2622 };
2623
2624 static const VMStateDescription vmstate_ringsize = {
2625 .name = "ringsize_state",
2626 .version_id = 1,
2627 .minimum_version_id = 1,
2628 .fields = (VMStateField[]) {
2629 VMSTATE_UINT32(vring.num_default, struct VirtQueue),
2630 VMSTATE_END_OF_LIST()
2631 }
2632 };
2633
2634 static const VMStateDescription vmstate_virtio_ringsize = {
2635 .name = "virtio/ringsize",
2636 .version_id = 1,
2637 .minimum_version_id = 1,
2638 .needed = &virtio_ringsize_needed,
2639 .fields = (VMStateField[]) {
2640 VMSTATE_STRUCT_VARRAY_POINTER_KNOWN(vq, struct VirtIODevice,
2641 VIRTIO_QUEUE_MAX, 0, vmstate_ringsize, VirtQueue),
2642 VMSTATE_END_OF_LIST()
2643 }
2644 };
2645
2646 static int get_extra_state(QEMUFile *f, void *pv, size_t size,
2647 const VMStateField *field)
2648 {
2649 VirtIODevice *vdev = pv;
2650 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2651 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2652
2653 if (!k->load_extra_state) {
2654 return -1;
2655 } else {
2656 return k->load_extra_state(qbus->parent, f);
2657 }
2658 }
2659
2660 static int put_extra_state(QEMUFile *f, void *pv, size_t size,
2661 const VMStateField *field, QJSON *vmdesc)
2662 {
2663 VirtIODevice *vdev = pv;
2664 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2665 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2666
2667 k->save_extra_state(qbus->parent, f);
2668 return 0;
2669 }
2670
2671 static const VMStateInfo vmstate_info_extra_state = {
2672 .name = "virtqueue_extra_state",
2673 .get = get_extra_state,
2674 .put = put_extra_state,
2675 };
2676
2677 static const VMStateDescription vmstate_virtio_extra_state = {
2678 .name = "virtio/extra_state",
2679 .version_id = 1,
2680 .minimum_version_id = 1,
2681 .needed = &virtio_extra_state_needed,
2682 .fields = (VMStateField[]) {
2683 {
2684 .name = "extra_state",
2685 .version_id = 0,
2686 .field_exists = NULL,
2687 .size = 0,
2688 .info = &vmstate_info_extra_state,
2689 .flags = VMS_SINGLE,
2690 .offset = 0,
2691 },
2692 VMSTATE_END_OF_LIST()
2693 }
2694 };
2695
2696 static const VMStateDescription vmstate_virtio_device_endian = {
2697 .name = "virtio/device_endian",
2698 .version_id = 1,
2699 .minimum_version_id = 1,
2700 .needed = &virtio_device_endian_needed,
2701 .fields = (VMStateField[]) {
2702 VMSTATE_UINT8(device_endian, VirtIODevice),
2703 VMSTATE_END_OF_LIST()
2704 }
2705 };
2706
2707 static const VMStateDescription vmstate_virtio_64bit_features = {
2708 .name = "virtio/64bit_features",
2709 .version_id = 1,
2710 .minimum_version_id = 1,
2711 .needed = &virtio_64bit_features_needed,
2712 .fields = (VMStateField[]) {
2713 VMSTATE_UINT64(guest_features, VirtIODevice),
2714 VMSTATE_END_OF_LIST()
2715 }
2716 };
2717
2718 static const VMStateDescription vmstate_virtio_broken = {
2719 .name = "virtio/broken",
2720 .version_id = 1,
2721 .minimum_version_id = 1,
2722 .needed = &virtio_broken_needed,
2723 .fields = (VMStateField[]) {
2724 VMSTATE_BOOL(broken, VirtIODevice),
2725 VMSTATE_END_OF_LIST()
2726 }
2727 };
2728
2729 static const VMStateDescription vmstate_virtio_started = {
2730 .name = "virtio/started",
2731 .version_id = 1,
2732 .minimum_version_id = 1,
2733 .needed = &virtio_started_needed,
2734 .fields = (VMStateField[]) {
2735 VMSTATE_BOOL(started, VirtIODevice),
2736 VMSTATE_END_OF_LIST()
2737 }
2738 };
2739
2740 static const VMStateDescription vmstate_virtio_disabled = {
2741 .name = "virtio/disabled",
2742 .version_id = 1,
2743 .minimum_version_id = 1,
2744 .needed = &virtio_disabled_needed,
2745 .fields = (VMStateField[]) {
2746 VMSTATE_BOOL(disabled, VirtIODevice),
2747 VMSTATE_END_OF_LIST()
2748 }
2749 };
2750
2751 static const VMStateDescription vmstate_virtio = {
2752 .name = "virtio",
2753 .version_id = 1,
2754 .minimum_version_id = 1,
2755 .minimum_version_id_old = 1,
2756 .fields = (VMStateField[]) {
2757 VMSTATE_END_OF_LIST()
2758 },
2759 .subsections = (const VMStateDescription*[]) {
2760 &vmstate_virtio_device_endian,
2761 &vmstate_virtio_64bit_features,
2762 &vmstate_virtio_virtqueues,
2763 &vmstate_virtio_ringsize,
2764 &vmstate_virtio_broken,
2765 &vmstate_virtio_extra_state,
2766 &vmstate_virtio_started,
2767 &vmstate_virtio_packed_virtqueues,
2768 &vmstate_virtio_disabled,
2769 NULL
2770 }
2771 };
2772
2773 int virtio_save(VirtIODevice *vdev, QEMUFile *f)
2774 {
2775 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2776 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2777 VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
2778 uint32_t guest_features_lo = (vdev->guest_features & 0xffffffff);
2779 int i;
2780
2781 if (k->save_config) {
2782 k->save_config(qbus->parent, f);
2783 }
2784
2785 qemu_put_8s(f, &vdev->status);
2786 qemu_put_8s(f, &vdev->isr);
2787 qemu_put_be16s(f, &vdev->queue_sel);
2788 qemu_put_be32s(f, &guest_features_lo);
2789 qemu_put_be32(f, vdev->config_len);
2790 qemu_put_buffer(f, vdev->config, vdev->config_len);
2791
2792 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2793 if (vdev->vq[i].vring.num == 0)
2794 break;
2795 }
2796
2797 qemu_put_be32(f, i);
2798
2799 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2800 if (vdev->vq[i].vring.num == 0)
2801 break;
2802
2803 qemu_put_be32(f, vdev->vq[i].vring.num);
2804 if (k->has_variable_vring_alignment) {
2805 qemu_put_be32(f, vdev->vq[i].vring.align);
2806 }
2807 /*
2808 * Save desc now, the rest of the ring addresses are saved in
2809 * subsections for VIRTIO-1 devices.
2810 */
2811 qemu_put_be64(f, vdev->vq[i].vring.desc);
2812 qemu_put_be16s(f, &vdev->vq[i].last_avail_idx);
2813 if (k->save_queue) {
2814 k->save_queue(qbus->parent, i, f);
2815 }
2816 }
2817
2818 if (vdc->save != NULL) {
2819 vdc->save(vdev, f);
2820 }
2821
2822 if (vdc->vmsd) {
2823 int ret = vmstate_save_state(f, vdc->vmsd, vdev, NULL);
2824 if (ret) {
2825 return ret;
2826 }
2827 }
2828
2829 /* Subsections */
2830 return vmstate_save_state(f, &vmstate_virtio, vdev, NULL);
2831 }
2832
2833 /* A wrapper for use as a VMState .put function */
2834 static int virtio_device_put(QEMUFile *f, void *opaque, size_t size,
2835 const VMStateField *field, QJSON *vmdesc)
2836 {
2837 return virtio_save(VIRTIO_DEVICE(opaque), f);
2838 }
2839
2840 /* A wrapper for use as a VMState .get function */
2841 static int virtio_device_get(QEMUFile *f, void *opaque, size_t size,
2842 const VMStateField *field)
2843 {
2844 VirtIODevice *vdev = VIRTIO_DEVICE(opaque);
2845 DeviceClass *dc = DEVICE_CLASS(VIRTIO_DEVICE_GET_CLASS(vdev));
2846
2847 return virtio_load(vdev, f, dc->vmsd->version_id);
2848 }
2849
2850 const VMStateInfo virtio_vmstate_info = {
2851 .name = "virtio",
2852 .get = virtio_device_get,
2853 .put = virtio_device_put,
2854 };
2855
2856 static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val)
2857 {
2858 VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
2859 bool bad = (val & ~(vdev->host_features)) != 0;
2860
2861 val &= vdev->host_features;
2862 if (k->set_features) {
2863 k->set_features(vdev, val);
2864 }
2865 vdev->guest_features = val;
2866 return bad ? -1 : 0;
2867 }
2868
2869 int virtio_set_features(VirtIODevice *vdev, uint64_t val)
2870 {
2871 int ret;
2872 /*
2873 * The driver must not attempt to set features after feature negotiation
2874 * has finished.
2875 */
2876 if (vdev->status & VIRTIO_CONFIG_S_FEATURES_OK) {
2877 return -EINVAL;
2878 }
2879 ret = virtio_set_features_nocheck(vdev, val);
2880 if (!ret) {
2881 if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
2882 /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches. */
2883 int i;
2884 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
2885 if (vdev->vq[i].vring.num != 0) {
2886 virtio_init_region_cache(vdev, i);
2887 }
2888 }
2889 }
2890
2891 if (!virtio_device_started(vdev, vdev->status) &&
2892 !virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
2893 vdev->start_on_kick = true;
2894 }
2895 }
2896 return ret;
2897 }
2898
2899 size_t virtio_feature_get_config_size(VirtIOFeature *feature_sizes,
2900 uint64_t host_features)
2901 {
2902 size_t config_size = 0;
2903 int i;
2904
2905 for (i = 0; feature_sizes[i].flags != 0; i++) {
2906 if (host_features & feature_sizes[i].flags) {
2907 config_size = MAX(feature_sizes[i].end, config_size);
2908 }
2909 }
2910
2911 return config_size;
2912 }
2913
2914 int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
2915 {
2916 int i, ret;
2917 int32_t config_len;
2918 uint32_t num;
2919 uint32_t features;
2920 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
2921 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
2922 VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
2923
2924 /*
2925 * We poison the endianness to ensure it does not get used before
2926 * subsections have been loaded.
2927 */
2928 vdev->device_endian = VIRTIO_DEVICE_ENDIAN_UNKNOWN;
2929
2930 if (k->load_config) {
2931 ret = k->load_config(qbus->parent, f);
2932 if (ret)
2933 return ret;
2934 }
2935
2936 qemu_get_8s(f, &vdev->status);
2937 qemu_get_8s(f, &vdev->isr);
2938 qemu_get_be16s(f, &vdev->queue_sel);
2939 if (vdev->queue_sel >= VIRTIO_QUEUE_MAX) {
2940 return -1;
2941 }
2942 qemu_get_be32s(f, &features);
2943
2944 /*
2945 * Temporarily set guest_features low bits - needed by
2946 * virtio net load code testing for VIRTIO_NET_F_CTRL_GUEST_OFFLOADS
2947 * VIRTIO_NET_F_GUEST_ANNOUNCE and VIRTIO_NET_F_CTRL_VQ.
2948 *
2949 * Note: devices should always test host features in future - don't create
2950 * new dependencies like this.
2951 */
2952 vdev->guest_features = features;
2953
2954 config_len = qemu_get_be32(f);
2955
2956 /*
2957 * There are cases where the incoming config can be bigger or smaller
2958 * than what we have; so load what we have space for, and skip
2959 * any excess that's in the stream.
2960 */
2961 qemu_get_buffer(f, vdev->config, MIN(config_len, vdev->config_len));
2962
2963 while (config_len > vdev->config_len) {
2964 qemu_get_byte(f);
2965 config_len--;
2966 }
2967
2968 num = qemu_get_be32(f);
2969
2970 if (num > VIRTIO_QUEUE_MAX) {
2971 error_report("Invalid number of virtqueues: 0x%x", num);
2972 return -1;
2973 }
2974
2975 for (i = 0; i < num; i++) {
2976 vdev->vq[i].vring.num = qemu_get_be32(f);
2977 if (k->has_variable_vring_alignment) {
2978 vdev->vq[i].vring.align = qemu_get_be32(f);
2979 }
2980 vdev->vq[i].vring.desc = qemu_get_be64(f);
2981 qemu_get_be16s(f, &vdev->vq[i].last_avail_idx);
2982 vdev->vq[i].signalled_used_valid = false;
2983 vdev->vq[i].notification = true;
2984
2985 if (!vdev->vq[i].vring.desc && vdev->vq[i].last_avail_idx) {
2986 error_report("VQ %d address 0x0 "
2987 "inconsistent with Host index 0x%x",
2988 i, vdev->vq[i].last_avail_idx);
2989 return -1;
2990 }
2991 if (k->load_queue) {
2992 ret = k->load_queue(qbus->parent, i, f);
2993 if (ret)
2994 return ret;
2995 }
2996 }
2997
2998 virtio_notify_vector(vdev, VIRTIO_NO_VECTOR);
2999
3000 if (vdc->load != NULL) {
3001 ret = vdc->load(vdev, f, version_id);
3002 if (ret) {
3003 return ret;
3004 }
3005 }
3006
3007 if (vdc->vmsd) {
3008 ret = vmstate_load_state(f, vdc->vmsd, vdev, version_id);
3009 if (ret) {
3010 return ret;
3011 }
3012 }
3013
3014 /* Subsections */
3015 ret = vmstate_load_state(f, &vmstate_virtio, vdev, 1);
3016 if (ret) {
3017 return ret;
3018 }
3019
3020 if (vdev->device_endian == VIRTIO_DEVICE_ENDIAN_UNKNOWN) {
3021 vdev->device_endian = virtio_default_endian();
3022 }
3023
3024 if (virtio_64bit_features_needed(vdev)) {
3025 /*
3026 * Subsection load filled vdev->guest_features. Run them
3027 * through virtio_set_features to sanity-check them against
3028 * host_features.
3029 */
3030 uint64_t features64 = vdev->guest_features;
3031 if (virtio_set_features_nocheck(vdev, features64) < 0) {
3032 error_report("Features 0x%" PRIx64 " unsupported. "
3033 "Allowed features: 0x%" PRIx64,
3034 features64, vdev->host_features);
3035 return -1;
3036 }
3037 } else {
3038 if (virtio_set_features_nocheck(vdev, features) < 0) {
3039 error_report("Features 0x%x unsupported. "
3040 "Allowed features: 0x%" PRIx64,
3041 features, vdev->host_features);
3042 return -1;
3043 }
3044 }
3045
3046 if (!virtio_device_started(vdev, vdev->status) &&
3047 !virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
3048 vdev->start_on_kick = true;
3049 }
3050
3051 RCU_READ_LOCK_GUARD();
3052 for (i = 0; i < num; i++) {
3053 if (vdev->vq[i].vring.desc) {
3054 uint16_t nheads;
3055
3056 /*
3057 * VIRTIO-1 devices migrate desc, used, and avail ring addresses so
3058 * only the region cache needs to be set up. Legacy devices need
3059 * to calculate used and avail ring addresses based on the desc
3060 * address.
3061 */
3062 if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
3063 virtio_init_region_cache(vdev, i);
3064 } else {
3065 virtio_queue_update_rings(vdev, i);
3066 }
3067
3068 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3069 vdev->vq[i].shadow_avail_idx = vdev->vq[i].last_avail_idx;
3070 vdev->vq[i].shadow_avail_wrap_counter =
3071 vdev->vq[i].last_avail_wrap_counter;
3072 continue;
3073 }
3074
3075 nheads = vring_avail_idx(&vdev->vq[i]) - vdev->vq[i].last_avail_idx;
3076 /* Check it isn't doing strange things with descriptor numbers. */
3077 if (nheads > vdev->vq[i].vring.num) {
3078 error_report("VQ %d size 0x%x Guest index 0x%x "
3079 "inconsistent with Host index 0x%x: delta 0x%x",
3080 i, vdev->vq[i].vring.num,
3081 vring_avail_idx(&vdev->vq[i]),
3082 vdev->vq[i].last_avail_idx, nheads);
3083 return -1;
3084 }
3085 vdev->vq[i].used_idx = vring_used_idx(&vdev->vq[i]);
3086 vdev->vq[i].shadow_avail_idx = vring_avail_idx(&vdev->vq[i]);
3087
3088 /*
3089 * Some devices migrate VirtQueueElements that have been popped
3090 * from the avail ring but not yet returned to the used ring.
3091 * Since max ring size < UINT16_MAX it's safe to use modulo
3092 * UINT16_MAX + 1 subtraction.
3093 */
3094 vdev->vq[i].inuse = (uint16_t)(vdev->vq[i].last_avail_idx -
3095 vdev->vq[i].used_idx);
3096 if (vdev->vq[i].inuse > vdev->vq[i].vring.num) {
3097 error_report("VQ %d size 0x%x < last_avail_idx 0x%x - "
3098 "used_idx 0x%x",
3099 i, vdev->vq[i].vring.num,
3100 vdev->vq[i].last_avail_idx,
3101 vdev->vq[i].used_idx);
3102 return -1;
3103 }
3104 }
3105 }
3106
3107 if (vdc->post_load) {
3108 ret = vdc->post_load(vdev);
3109 if (ret) {
3110 return ret;
3111 }
3112 }
3113
3114 return 0;
3115 }
3116
3117 void virtio_cleanup(VirtIODevice *vdev)
3118 {
3119 qemu_del_vm_change_state_handler(vdev->vmstate);
3120 }
3121
3122 static void virtio_vmstate_change(void *opaque, int running, RunState state)
3123 {
3124 VirtIODevice *vdev = opaque;
3125 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3126 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
3127 bool backend_run = running && virtio_device_started(vdev, vdev->status);
3128 vdev->vm_running = running;
3129
3130 if (backend_run) {
3131 virtio_set_status(vdev, vdev->status);
3132 }
3133
3134 if (k->vmstate_change) {
3135 k->vmstate_change(qbus->parent, backend_run);
3136 }
3137
3138 if (!backend_run) {
3139 virtio_set_status(vdev, vdev->status);
3140 }
3141 }
3142
3143 void virtio_instance_init_common(Object *proxy_obj, void *data,
3144 size_t vdev_size, const char *vdev_name)
3145 {
3146 DeviceState *vdev = data;
3147
3148 object_initialize_child(proxy_obj, "virtio-backend", vdev, vdev_size,
3149 vdev_name, &error_abort, NULL);
3150 qdev_alias_all_properties(vdev, proxy_obj);
3151 }
3152
3153 void virtio_init(VirtIODevice *vdev, const char *name,
3154 uint16_t device_id, size_t config_size)
3155 {
3156 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3157 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
3158 int i;
3159 int nvectors = k->query_nvectors ? k->query_nvectors(qbus->parent) : 0;
3160
3161 if (nvectors) {
3162 vdev->vector_queues =
3163 g_malloc0(sizeof(*vdev->vector_queues) * nvectors);
3164 }
3165
3166 vdev->start_on_kick = false;
3167 vdev->started = false;
3168 vdev->device_id = device_id;
3169 vdev->status = 0;
3170 atomic_set(&vdev->isr, 0);
3171 vdev->queue_sel = 0;
3172 vdev->config_vector = VIRTIO_NO_VECTOR;
3173 vdev->vq = g_malloc0(sizeof(VirtQueue) * VIRTIO_QUEUE_MAX);
3174 vdev->vm_running = runstate_is_running();
3175 vdev->broken = false;
3176 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
3177 vdev->vq[i].vector = VIRTIO_NO_VECTOR;
3178 vdev->vq[i].vdev = vdev;
3179 vdev->vq[i].queue_index = i;
3180 vdev->vq[i].host_notifier_enabled = false;
3181 }
3182
3183 vdev->name = name;
3184 vdev->config_len = config_size;
3185 if (vdev->config_len) {
3186 vdev->config = g_malloc0(config_size);
3187 } else {
3188 vdev->config = NULL;
3189 }
3190 vdev->vmstate = qdev_add_vm_change_state_handler(DEVICE(vdev),
3191 virtio_vmstate_change, vdev);
3192 vdev->device_endian = virtio_default_endian();
3193 vdev->use_guest_notifier_mask = true;
3194 }
3195
3196 hwaddr virtio_queue_get_desc_addr(VirtIODevice *vdev, int n)
3197 {
3198 return vdev->vq[n].vring.desc;
3199 }
3200
3201 bool virtio_queue_enabled(VirtIODevice *vdev, int n)
3202 {
3203 return virtio_queue_get_desc_addr(vdev, n) != 0;
3204 }
3205
3206 hwaddr virtio_queue_get_avail_addr(VirtIODevice *vdev, int n)
3207 {
3208 return vdev->vq[n].vring.avail;
3209 }
3210
3211 hwaddr virtio_queue_get_used_addr(VirtIODevice *vdev, int n)
3212 {
3213 return vdev->vq[n].vring.used;
3214 }
3215
3216 hwaddr virtio_queue_get_desc_size(VirtIODevice *vdev, int n)
3217 {
3218 return sizeof(VRingDesc) * vdev->vq[n].vring.num;
3219 }
3220
3221 hwaddr virtio_queue_get_avail_size(VirtIODevice *vdev, int n)
3222 {
3223 int s;
3224
3225 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3226 return sizeof(struct VRingPackedDescEvent);
3227 }
3228
3229 s = virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
3230 return offsetof(VRingAvail, ring) +
3231 sizeof(uint16_t) * vdev->vq[n].vring.num + s;
3232 }
3233
3234 hwaddr virtio_queue_get_used_size(VirtIODevice *vdev, int n)
3235 {
3236 int s;
3237
3238 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3239 return sizeof(struct VRingPackedDescEvent);
3240 }
3241
3242 s = virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX) ? 2 : 0;
3243 return offsetof(VRingUsed, ring) +
3244 sizeof(VRingUsedElem) * vdev->vq[n].vring.num + s;
3245 }
3246
3247 static unsigned int virtio_queue_packed_get_last_avail_idx(VirtIODevice *vdev,
3248 int n)
3249 {
3250 unsigned int avail, used;
3251
3252 avail = vdev->vq[n].last_avail_idx;
3253 avail |= ((uint16_t)vdev->vq[n].last_avail_wrap_counter) << 15;
3254
3255 used = vdev->vq[n].used_idx;
3256 used |= ((uint16_t)vdev->vq[n].used_wrap_counter) << 15;
3257
3258 return avail | used << 16;
3259 }
3260
3261 static uint16_t virtio_queue_split_get_last_avail_idx(VirtIODevice *vdev,
3262 int n)
3263 {
3264 return vdev->vq[n].last_avail_idx;
3265 }
3266
3267 unsigned int virtio_queue_get_last_avail_idx(VirtIODevice *vdev, int n)
3268 {
3269 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3270 return virtio_queue_packed_get_last_avail_idx(vdev, n);
3271 } else {
3272 return virtio_queue_split_get_last_avail_idx(vdev, n);
3273 }
3274 }
3275
3276 static void virtio_queue_packed_set_last_avail_idx(VirtIODevice *vdev,
3277 int n, unsigned int idx)
3278 {
3279 struct VirtQueue *vq = &vdev->vq[n];
3280
3281 vq->last_avail_idx = vq->shadow_avail_idx = idx & 0x7fff;
3282 vq->last_avail_wrap_counter =
3283 vq->shadow_avail_wrap_counter = !!(idx & 0x8000);
3284 idx >>= 16;
3285 vq->used_idx = idx & 0x7ffff;
3286 vq->used_wrap_counter = !!(idx & 0x8000);
3287 }
3288
3289 static void virtio_queue_split_set_last_avail_idx(VirtIODevice *vdev,
3290 int n, unsigned int idx)
3291 {
3292 vdev->vq[n].last_avail_idx = idx;
3293 vdev->vq[n].shadow_avail_idx = idx;
3294 }
3295
3296 void virtio_queue_set_last_avail_idx(VirtIODevice *vdev, int n,
3297 unsigned int idx)
3298 {
3299 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3300 virtio_queue_packed_set_last_avail_idx(vdev, n, idx);
3301 } else {
3302 virtio_queue_split_set_last_avail_idx(vdev, n, idx);
3303 }
3304 }
3305
3306 static void virtio_queue_packed_restore_last_avail_idx(VirtIODevice *vdev,
3307 int n)
3308 {
3309 /* We don't have a reference like avail idx in shared memory */
3310 return;
3311 }
3312
3313 static void virtio_queue_split_restore_last_avail_idx(VirtIODevice *vdev,
3314 int n)
3315 {
3316 RCU_READ_LOCK_GUARD();
3317 if (vdev->vq[n].vring.desc) {
3318 vdev->vq[n].last_avail_idx = vring_used_idx(&vdev->vq[n]);
3319 vdev->vq[n].shadow_avail_idx = vdev->vq[n].last_avail_idx;
3320 }
3321 }
3322
3323 void virtio_queue_restore_last_avail_idx(VirtIODevice *vdev, int n)
3324 {
3325 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3326 virtio_queue_packed_restore_last_avail_idx(vdev, n);
3327 } else {
3328 virtio_queue_split_restore_last_avail_idx(vdev, n);
3329 }
3330 }
3331
3332 static void virtio_queue_packed_update_used_idx(VirtIODevice *vdev, int n)
3333 {
3334 /* used idx was updated through set_last_avail_idx() */
3335 return;
3336 }
3337
3338 static void virtio_split_packed_update_used_idx(VirtIODevice *vdev, int n)
3339 {
3340 RCU_READ_LOCK_GUARD();
3341 if (vdev->vq[n].vring.desc) {
3342 vdev->vq[n].used_idx = vring_used_idx(&vdev->vq[n]);
3343 }
3344 }
3345
3346 void virtio_queue_update_used_idx(VirtIODevice *vdev, int n)
3347 {
3348 if (virtio_vdev_has_feature(vdev, VIRTIO_F_RING_PACKED)) {
3349 return virtio_queue_packed_update_used_idx(vdev, n);
3350 } else {
3351 return virtio_split_packed_update_used_idx(vdev, n);
3352 }
3353 }
3354
3355 void virtio_queue_invalidate_signalled_used(VirtIODevice *vdev, int n)
3356 {
3357 vdev->vq[n].signalled_used_valid = false;
3358 }
3359
3360 VirtQueue *virtio_get_queue(VirtIODevice *vdev, int n)
3361 {
3362 return vdev->vq + n;
3363 }
3364
3365 uint16_t virtio_get_queue_index(VirtQueue *vq)
3366 {
3367 return vq->queue_index;
3368 }
3369
3370 static void virtio_queue_guest_notifier_read(EventNotifier *n)
3371 {
3372 VirtQueue *vq = container_of(n, VirtQueue, guest_notifier);
3373 if (event_notifier_test_and_clear(n)) {
3374 virtio_irq(vq);
3375 }
3376 }
3377
3378 void virtio_queue_set_guest_notifier_fd_handler(VirtQueue *vq, bool assign,
3379 bool with_irqfd)
3380 {
3381 if (assign && !with_irqfd) {
3382 event_notifier_set_handler(&vq->guest_notifier,
3383 virtio_queue_guest_notifier_read);
3384 } else {
3385 event_notifier_set_handler(&vq->guest_notifier, NULL);
3386 }
3387 if (!assign) {
3388 /* Test and clear notifier before closing it,
3389 * in case poll callback didn't have time to run. */
3390 virtio_queue_guest_notifier_read(&vq->guest_notifier);
3391 }
3392 }
3393
3394 EventNotifier *virtio_queue_get_guest_notifier(VirtQueue *vq)
3395 {
3396 return &vq->guest_notifier;
3397 }
3398
3399 static void virtio_queue_host_notifier_aio_read(EventNotifier *n)
3400 {
3401 VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
3402 if (event_notifier_test_and_clear(n)) {
3403 virtio_queue_notify_aio_vq(vq);
3404 }
3405 }
3406
3407 static void virtio_queue_host_notifier_aio_poll_begin(EventNotifier *n)
3408 {
3409 VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
3410
3411 virtio_queue_set_notification(vq, 0);
3412 }
3413
3414 static bool virtio_queue_host_notifier_aio_poll(void *opaque)
3415 {
3416 EventNotifier *n = opaque;
3417 VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
3418
3419 if (!vq->vring.desc || virtio_queue_empty(vq)) {
3420 return false;
3421 }
3422
3423 return virtio_queue_notify_aio_vq(vq);
3424 }
3425
3426 static void virtio_queue_host_notifier_aio_poll_end(EventNotifier *n)
3427 {
3428 VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
3429
3430 /* Caller polls once more after this to catch requests that race with us */
3431 virtio_queue_set_notification(vq, 1);
3432 }
3433
3434 void virtio_queue_aio_set_host_notifier_handler(VirtQueue *vq, AioContext *ctx,
3435 VirtIOHandleAIOOutput handle_output)
3436 {
3437 if (handle_output) {
3438 vq->handle_aio_output = handle_output;
3439 aio_set_event_notifier(ctx, &vq->host_notifier, true,
3440 virtio_queue_host_notifier_aio_read,
3441 virtio_queue_host_notifier_aio_poll);
3442 aio_set_event_notifier_poll(ctx, &vq->host_notifier,
3443 virtio_queue_host_notifier_aio_poll_begin,
3444 virtio_queue_host_notifier_aio_poll_end);
3445 } else {
3446 aio_set_event_notifier(ctx, &vq->host_notifier, true, NULL, NULL);
3447 /* Test and clear notifier before after disabling event,
3448 * in case poll callback didn't have time to run. */
3449 virtio_queue_host_notifier_aio_read(&vq->host_notifier);
3450 vq->handle_aio_output = NULL;
3451 }
3452 }
3453
3454 void virtio_queue_host_notifier_read(EventNotifier *n)
3455 {
3456 VirtQueue *vq = container_of(n, VirtQueue, host_notifier);
3457 if (event_notifier_test_and_clear(n)) {
3458 virtio_queue_notify_vq(vq);
3459 }
3460 }
3461
3462 EventNotifier *virtio_queue_get_host_notifier(VirtQueue *vq)
3463 {
3464 return &vq->host_notifier;
3465 }
3466
3467 void virtio_queue_set_host_notifier_enabled(VirtQueue *vq, bool enabled)
3468 {
3469 vq->host_notifier_enabled = enabled;
3470 }
3471
3472 int virtio_queue_set_host_notifier_mr(VirtIODevice *vdev, int n,
3473 MemoryRegion *mr, bool assign)
3474 {
3475 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3476 VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
3477
3478 if (k->set_host_notifier_mr) {
3479 return k->set_host_notifier_mr(qbus->parent, n, mr, assign);
3480 }
3481
3482 return -1;
3483 }
3484
3485 void virtio_device_set_child_bus_name(VirtIODevice *vdev, char *bus_name)
3486 {
3487 g_free(vdev->bus_name);
3488 vdev->bus_name = g_strdup(bus_name);
3489 }
3490
3491 void GCC_FMT_ATTR(2, 3) virtio_error(VirtIODevice *vdev, const char *fmt, ...)
3492 {
3493 va_list ap;
3494
3495 va_start(ap, fmt);
3496 error_vreport(fmt, ap);
3497 va_end(ap);
3498
3499 if (virtio_vdev_has_feature(vdev, VIRTIO_F_VERSION_1)) {
3500 vdev->status = vdev->status | VIRTIO_CONFIG_S_NEEDS_RESET;
3501 virtio_notify_config(vdev);
3502 }
3503
3504 vdev->broken = true;
3505 }
3506
3507 static void virtio_memory_listener_commit(MemoryListener *listener)
3508 {
3509 VirtIODevice *vdev = container_of(listener, VirtIODevice, listener);
3510 int i;
3511
3512 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
3513 if (vdev->vq[i].vring.num == 0) {
3514 break;
3515 }
3516 virtio_init_region_cache(vdev, i);
3517 }
3518 }
3519
3520 static void virtio_device_realize(DeviceState *dev, Error **errp)
3521 {
3522 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
3523 VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(dev);
3524 Error *err = NULL;
3525
3526 /* Devices should either use vmsd or the load/save methods */
3527 assert(!vdc->vmsd || !vdc->load);
3528
3529 if (vdc->realize != NULL) {
3530 vdc->realize(dev, &err);
3531 if (err != NULL) {
3532 error_propagate(errp, err);
3533 return;
3534 }
3535 }
3536
3537 virtio_bus_device_plugged(vdev, &err);
3538 if (err != NULL) {
3539 error_propagate(errp, err);
3540 vdc->unrealize(dev, NULL);
3541 return;
3542 }
3543
3544 vdev->listener.commit = virtio_memory_listener_commit;
3545 memory_listener_register(&vdev->listener, vdev->dma_as);
3546 }
3547
3548 static void virtio_device_unrealize(DeviceState *dev, Error **errp)
3549 {
3550 VirtIODevice *vdev = VIRTIO_DEVICE(dev);
3551 VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(dev);
3552 Error *err = NULL;
3553
3554 virtio_bus_device_unplugged(vdev);
3555
3556 if (vdc->unrealize != NULL) {
3557 vdc->unrealize(dev, &err);
3558 if (err != NULL) {
3559 error_propagate(errp, err);
3560 return;
3561 }
3562 }
3563
3564 g_free(vdev->bus_name);
3565 vdev->bus_name = NULL;
3566 }
3567
3568 static void virtio_device_free_virtqueues(VirtIODevice *vdev)
3569 {
3570 int i;
3571 if (!vdev->vq) {
3572 return;
3573 }
3574
3575 for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
3576 if (vdev->vq[i].vring.num == 0) {
3577 break;
3578 }
3579 virtio_virtqueue_reset_region_cache(&vdev->vq[i]);
3580 }
3581 g_free(vdev->vq);
3582 }
3583
3584 static void virtio_device_instance_finalize(Object *obj)
3585 {
3586 VirtIODevice *vdev = VIRTIO_DEVICE(obj);
3587
3588 memory_listener_unregister(&vdev->listener);
3589 virtio_device_free_virtqueues(vdev);
3590
3591 g_free(vdev->config);
3592 g_free(vdev->vector_queues);
3593 }
3594
3595 static Property virtio_properties[] = {
3596 DEFINE_VIRTIO_COMMON_FEATURES(VirtIODevice, host_features),
3597 DEFINE_PROP_BOOL("use-started", VirtIODevice, use_started, true),
3598 DEFINE_PROP_BOOL("use-disabled-flag", VirtIODevice, use_disabled_flag, true),
3599 DEFINE_PROP_END_OF_LIST(),
3600 };
3601
3602 static int virtio_device_start_ioeventfd_impl(VirtIODevice *vdev)
3603 {
3604 VirtioBusState *qbus = VIRTIO_BUS(qdev_get_parent_bus(DEVICE(vdev)));
3605 int i, n, r, err;
3606
3607 memory_region_transaction_begin();
3608 for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
3609 VirtQueue *vq = &vdev->vq[n];
3610 if (!virtio_queue_get_num(vdev, n)) {
3611 continue;
3612 }
3613 r = virtio_bus_set_host_notifier(qbus, n, true);
3614 if (r < 0) {
3615 err = r;
3616 goto assign_error;
3617 }
3618 event_notifier_set_handler(&vq->host_notifier,
3619 virtio_queue_host_notifier_read);
3620 }
3621
3622 for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
3623 /* Kick right away to begin processing requests already in vring */
3624 VirtQueue *vq = &vdev->vq[n];
3625 if (!vq->vring.num) {
3626 continue;
3627 }
3628 event_notifier_set(&vq->host_notifier);
3629 }
3630 memory_region_transaction_commit();
3631 return 0;
3632
3633 assign_error:
3634 i = n; /* save n for a second iteration after transaction is committed. */
3635 while (--n >= 0) {
3636 VirtQueue *vq = &vdev->vq[n];
3637 if (!virtio_queue_get_num(vdev, n)) {
3638 continue;
3639 }
3640
3641 event_notifier_set_handler(&vq->host_notifier, NULL);
3642 r = virtio_bus_set_host_notifier(qbus, n, false);
3643 assert(r >= 0);
3644 }
3645 memory_region_transaction_commit();
3646
3647 while (--i >= 0) {
3648 if (!virtio_queue_get_num(vdev, i)) {
3649 continue;
3650 }
3651 virtio_bus_cleanup_host_notifier(qbus, i);
3652 }
3653 return err;
3654 }
3655
3656 int virtio_device_start_ioeventfd(VirtIODevice *vdev)
3657 {
3658 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3659 VirtioBusState *vbus = VIRTIO_BUS(qbus);
3660
3661 return virtio_bus_start_ioeventfd(vbus);
3662 }
3663
3664 static void virtio_device_stop_ioeventfd_impl(VirtIODevice *vdev)
3665 {
3666 VirtioBusState *qbus = VIRTIO_BUS(qdev_get_parent_bus(DEVICE(vdev)));
3667 int n, r;
3668
3669 memory_region_transaction_begin();
3670 for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
3671 VirtQueue *vq = &vdev->vq[n];
3672
3673 if (!virtio_queue_get_num(vdev, n)) {
3674 continue;
3675 }
3676 event_notifier_set_handler(&vq->host_notifier, NULL);
3677 r = virtio_bus_set_host_notifier(qbus, n, false);
3678 assert(r >= 0);
3679 }
3680 memory_region_transaction_commit();
3681
3682 for (n = 0; n < VIRTIO_QUEUE_MAX; n++) {
3683 if (!virtio_queue_get_num(vdev, n)) {
3684 continue;
3685 }
3686 virtio_bus_cleanup_host_notifier(qbus, n);
3687 }
3688 }
3689
3690 int virtio_device_grab_ioeventfd(VirtIODevice *vdev)
3691 {
3692 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3693 VirtioBusState *vbus = VIRTIO_BUS(qbus);
3694
3695 return virtio_bus_grab_ioeventfd(vbus);
3696 }
3697
3698 void virtio_device_release_ioeventfd(VirtIODevice *vdev)
3699 {
3700 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3701 VirtioBusState *vbus = VIRTIO_BUS(qbus);
3702
3703 virtio_bus_release_ioeventfd(vbus);
3704 }
3705
3706 static void virtio_device_class_init(ObjectClass *klass, void *data)
3707 {
3708 /* Set the default value here. */
3709 VirtioDeviceClass *vdc = VIRTIO_DEVICE_CLASS(klass);
3710 DeviceClass *dc = DEVICE_CLASS(klass);
3711
3712 dc->realize = virtio_device_realize;
3713 dc->unrealize = virtio_device_unrealize;
3714 dc->bus_type = TYPE_VIRTIO_BUS;
3715 dc->props = virtio_properties;
3716 vdc->start_ioeventfd = virtio_device_start_ioeventfd_impl;
3717 vdc->stop_ioeventfd = virtio_device_stop_ioeventfd_impl;
3718
3719 vdc->legacy_features |= VIRTIO_LEGACY_FEATURES;
3720 }
3721
3722 bool virtio_device_ioeventfd_enabled(VirtIODevice *vdev)
3723 {
3724 BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
3725 VirtioBusState *vbus = VIRTIO_BUS(qbus);
3726
3727 return virtio_bus_ioeventfd_enabled(vbus);
3728 }
3729
3730 static const TypeInfo virtio_device_info = {
3731 .name = TYPE_VIRTIO_DEVICE,
3732 .parent = TYPE_DEVICE,
3733 .instance_size = sizeof(VirtIODevice),
3734 .class_init = virtio_device_class_init,
3735 .instance_finalize = virtio_device_instance_finalize,
3736 .abstract = true,
3737 .class_size = sizeof(VirtioDeviceClass),
3738 };
3739
3740 static void virtio_register_types(void)
3741 {
3742 type_register_static(&virtio_device_info);
3743 }
3744
3745 type_init(virtio_register_types)
QEmu